Uber is currently reaching out to thousands of drivers across the United States to inform them that their sensitive personal details and driver’s license numbers have been compromised. The security lapse stems from an October cyberattack targeting a third-party technology vendor utilized by the ride-hailing company.

Regulatory filings submitted across multiple states indicate that the breach originated on October 9 when unauthorized actors infiltrated the vendor’s systems. The intruders successfully stole internal credentials, which were subsequently leveraged to access specific datasets belonging to Uber. While the exact total of affected individuals remains undisclosed, state-level filings reveal thousands of impacted drivers in regions such as Massachusetts, South Carolina, and Rhode Island, with numbers expected to climb as investigations proceed.

The vendor at the center of the incident has been identified as Fireworks AI, a platform that enables developers to utilize open-source artificial intelligence models. Representatives for Fireworks acknowledged that a security event involving unauthorized system access compromised customer data. The vendor attributed the intrusion to a financially motivated cybercriminal syndicate focused on stealing access tokens for large language models, highlighting the growing vulnerabilities tied to third-party AI service integrations.

Key Takeaways

• Thousands of Uber drivers are being notified that their personal information and driver's licenses were exposed.
• The breach occurred through a third-party AI technology provider, Fireworks AI, which suffered an unauthorized intrusion in October.
• Stolen data includes driver license numbers across multiple U.S. states, with the total number of affected individuals still growing.

Editor’s Analysis & Impact

This incident underscores a critical vulnerability in the modern corporate ecosystem: the heavy reliance on third-party vendors and specialized AI service providers. As companies integrate sophisticated third-party tools like Fireworks AI to streamline operations, they inadvertently expand their corporate attack surface. Supply chain cybersecurity has become one of the most pressing challenges for large enterprises. The fact that threat actors are specifically targeting platforms hosting large language models and development tools points to an evolving threat landscape where AI infrastructure is viewed as a high-value target. Moving forward, organizations must enforce stricter vendor risk management, continuous monitoring, and robust zero-trust architectures to prevent upstream breaches from cascading into major consumer and employee data leaks.

Frequently Asked Questions

Q: How did the data breach happen?
A: Hackers breached a third-party AI vendor used by Uber, stole internal credentials, and used them to access Uber's data stored on the vendor's systems.

Q: What information was stolen in the incident?
A: The compromised data includes personal information and driver's license numbers of thousands of Uber drivers across multiple U.S. states.

Q: Which vendor was responsible for the security lapse?
A: The security incident occurred at Fireworks AI, a platform that provides developers with access to open AI models.