Uber has disclosed in regulatory filings sent to multiple attorneys general that personal information and driver licenses belonging to thousands of drivers were exposed in a data breach. The company stated in the notification documents that a third-party service provider suffered a security breach on October 9, during which attackers stole internal credentials. The unauthorized actors then utilized those credentials to access Uber data linked to that specific vendor.
Third-Party Vendor Involvement
According to Engadget reporting based on information given directly to TechCrunch, the vendor involved in the security incident is Fireworks.ai, a cloud platform providing clients with access to open-source artificial intelligence models. Fireworks confirmed that it experienced a data breach last month, which affected client data. The company attributed the attack to a cybercriminal group known for selling stolen tokens used to access large language models. At this time, it remains uncertain whether the stolen driver information has been leaked online or sold.
Impact on Drivers
While neither Uber nor the vendor has disclosed the total number of impacted drivers globally, figures reported by TechCrunch from state filings indicate significant regional exposure. The incident exposed the driver licenses of 3,430 individuals in South Carolina, 2,567 people in Massachusetts, and 1,873 individuals in Rhode Island.
