Uber confirms hackers stole thousands of drivers’ license information

Uber is notifying thousands of drivers that their personal details and driver's license records were stolen following a cybersecurity intrusion at an external technology contractor. The transportation company submitted formal breach notifications this week to several state regulators, detailing findings described in TechCrunch's report on enterprise supply chain exposures. According to regulatory filings, digital intruders penetrated cloud infrastructure managed by artificial intelligence provider Fireworks AI to access stored files.

This report covers the mechanics of the vendor credential theft, verified driver exposure counts across state regulatory filings, and collateral data theft impacting other tech startups. Transportation workers, platform drivers, and enterprise security professionals can review verified state figures, vendor statements, and prior security incidents affecting the company's freight shipping division.

01Stolen internal credentials and vendor system access

Artificial intelligence infrastructure specialist Fireworks AI alerted the ride-hailing company on October 9 that an unauthorized party had breached its internal systems. During the compromise, hackers siphoned internal credentials that provided direct access to data Uber stored with the cloud provider. The transportation firm subsequently initiated notification procedures for affected drivers after discovering that their stored personal records had been compromised in the intrusion.

Uber submitted formal disclosures this week to multiple state attorneys general, including officials in California, confirming that internal credentials facilitated access to driver data. An Uber spokesperson stated that the notices to drivers relate to a security incident impacting Fireworks AI, which had legitimate access to company data. The corporate spokesperson deferred further technical inquiries regarding system defense directly to the vendor.

A spokesperson for Fireworks AI confirmed that the provider identified unauthorized access to some systems, resulting in the compromise of customer data. The representative did not address specific questions concerning the scope of the incident or how internal security controls were initially bypassed. Uber has not stated how many total customers or drivers were affected nationwide by the credential theft.

02AI model hosting and commercial token theft

Fireworks AI operates a cloud infrastructure platform that allows software developers to access and deploy open artificial intelligence models. The vendor publicly acknowledged a security incident last month where intruders stole customer information, including billing records and proprietary AI datasets. The platform's hosted environments store machine learning assets alongside administrative information required to manage external programmatic access.

Fireworks attributed the system intrusion to a financially motivated cybercriminal syndicate focused on acquiring and reselling computational access credentials. According to the cloud vendor, the intruders aimed to sell stolen digital tokens used to query large language models. No known cybercriminal group has claimed public credit for the data theft at the artificial intelligence provider.

03Regulatory filings across four state attorney offices

Public breach disclosures submitted to state law enforcement agencies provide verified counts of commercial drivers whose driver's license information was compromised. A filing with authorities in Massachusetts confirmed that hackers stole the driver's licenses of 2,567 individuals residing in the state. Parallel filings in South Carolina revealed that 3,430 drivers had their licenses stolen, while records in Rhode Island documented 1,873 affected residents.

A separate regulatory disclosure registered in Illinois established that local residents suffered driver's license theft, though the total count remains pending review. Uber also issued individual breach notifications to drivers based in California, but state filings did not specify the total number of affected residents. Authorities expect these figures to rise as additional state regulatory offices process formal notices from the ride-hailing company.

The company has withheld comprehensive national totals detailing the full volume of driver notifications dispatched across all operating territories. Filings show the stolen data specifically included driver's license records stored in vendor environments rather than active financial details. Regulators in affected states are tracking the notices as driver assistance procedures roll out across participating regional agencies.

04Productivity platform records and shared cloud datasets

The breach at Fireworks AI extends beyond transportation workers to impact other prominent corporate software environments utilizing cloud intelligence tooling. Online productivity and workspace startup Notion confirmed that its company data was also stolen during the unauthorized intrusion at the vendor. The disclosure reveals that multiple technology platforms sharing the same artificial intelligence supplier experienced simultaneous data exposure.

Fireworks disclosed last month that the intrusion compromised customer billing records along with select private artificial intelligence datasets stored on its systems. The exfiltration of datasets underscores the distinct security risks associated with routing sensitive internal information through specialized model hosting providers. Both Uber and Notion relied on the vendor's specialized infrastructure, exposing distinct categories of enterprise data to the same credential-harvesting campaign.

05Freight shipping incidents and recurring supply risks

The breach marks Uber's second disclosed cybersecurity failure this year, following an earlier digital intrusion within its logistics operations. The company previously disclosed a security incident impacting Uber Freight, its dedicated truck shipping division, where an extortion gang took credit for stealing operational files. That logistics compromise demonstrated persistent threat actor interest in penetrating the ride-sharing firm's broader corporate perimeter.

Unlike the direct extortion campaign mounted against the freight shipping division, the October incident bypassed internal corporate defenses via a third-party technology vendor. Attackers targeted Fireworks AI to harvest stored Uber records without directly penetrating the transportation company's proprietary datacenter infrastructure. State regulators continue examining the incident as Uber works to verify that external artificial intelligence providers maintain adequate safeguards for sensitive identity records.