Uber breach exposes about 7,900 license records via Fireworks AI

Attackers stole driver’s-license records from about 7,900 people through AI inference vendor Fireworks AI, according to Uber breach notices in Massachusetts, South Carolina and Rhode Island. Uber also notified drivers in California and Illinois, but has not published counts for either state or a companywide total.

An Uber spokesperson told TechCrunch: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.” The exposed information included personal information and driver’s-license details.

What do the notices actually count?

The notices seen by TechCrunch list:

• 2,567 people in Massachusetts.
• 3,430 people in South Carolina.
• 1,873 people in Rhode Island.

Those figures total about 7,900 people, and Uber expects the count to rise. The California and Illinois notices give no number of affected people, so the three-state figure does not represent the full exposure.

How did attackers reach Uber through the vendor?

Uber’s breach notice, dated Nov. 10 and posted by the California attorney general, says a service provider informed the company on Oct. 9 that an unauthorized party had stolen its internal credentials. The attackers used those credentials to access Uber’s account with the provider. Uber says it immediately severed data connections with the provider.

During its investigation, Uber found on Oct. 13 that the attackers had used the compromised credentials to reach Uber data connected to the provider. The California filing lists Oct. 7 as the breach date. A vendor credential works like a shared key: once stolen, it can open the customer account that the provider holds.

Uber says it has found no misuse of the data so far. The company is offering free credit monitoring through Cyberscout, a TransUnion company.

What did Fireworks AI disclose?

Uber confirmed to TechCrunch that the vendor was Fireworks AI, an AI inference company that disclosed its own breach last month. The company sells developers access to open AI models. It has confirmed that attackers stole customer account and billing information, along with secrets, datasets and incomplete models for some accounts.

A Fireworks spokesperson told TechCrunch that “unauthorized access to some of its systems affected customer data.” The spokesperson did not answer further questions. Notion also said that AI chat transcripts were exposed, extending the reported fallout beyond Uber’s driver data.

Fireworks has attributed the breach to a financially motivated group trying to sell stolen tokens for access to large language models. No group has claimed responsibility.

What does Uber still not disclose?

Uber has not disclosed a total number of affected drivers, and the about 7,900 figure covers only the three states with published counts. Its finding of no misuse so far describes activity in the exposed data, not the completeness of the notification process. The three-state total is expected to rise, so the notification record remains incomplete.

The dates place the vendor’s warning two days after the listed breach date, followed by four days before Uber found the accessed data. That sequence does not establish when the attackers first obtained the credentials.

TechCrunch described this as Uber’s second known breach this year, after a security incident at the Uber Freight unit. This disclosure concerns a third-party technology supplier and stolen driver data.

As the three-state count rises, vendor oversight becomes the immediate commercial issue for companies placing sensitive data behind shared AI services. Stronger credential controls and faster notification between AI suppliers and their customers will shape whether this exposure remains contained, while Uber’s missing companywide total leaves the full scope unsettled.