Uber confirms driver's license theft in Fireworks AI breach

Uber is notifying thousands of drivers that hackers stole their driver's license information during an October breach at Fireworks AI, a provider that runs open AI models for developers. The ride-hail company confirmed the incident in notices filed this week with several U.S. attorneys general, including California.

The vendor told Uber on October 9 that intruders had stolen internal credentials and used them to reach Uber's data. Uber then began informing affected drivers that their personal information sat with that provider.

TechCrunch identified the provider as Fireworks AI, a startup that lets developers access and use open AI models. Fireworks reported a data breach last month in which hackers stole customer information, including billing data and some private AI datasets. Online productivity startup Notion also confirmed that the Fireworks hack took its data.

"The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," an Uber spokesperson told TechCrunch. Uber deferred further questions to Fireworks. A Fireworks spokesperson did not respond to questions about the incident.

How many licenses were stolen?

Uber has not said how many customers or drivers the breach affected. The state-level filings, seen by TechCrunch, put a partial number on the damage:

• 2,567 individuals in Massachusetts had driver's license information stolen
• 3,430 people across South Carolina
• 1,873 residents of Rhode Island
• Illinois: some residents affected, exact number still pending
• California: drivers notified, count not disclosed

The total is expected to rise as more data breach notifications roll in.

Who is behind the hack?

Fireworks attributed its breach to a financially motivated cybercriminal group. The group's goal, according to the company, is to sell stolen tokens for accessing large language models. No known cybercriminal group has taken credit for the data theft.

That motive matters for what happens next. Stolen LLM tokens are a sellable commodity; stolen driver's licenses are another. One breach now feeds two markets.

A second breach for Uber this year

This is Uber's second known data breach of the year. The company also reported a security incident at Uber Freight, its truck shipping unit, for which an extortion gang took credit for stealing data.

Two breaches in a year is not a trend, but it is a pattern worth watching. Both incidents point at the same structural weakness: attackers reached Uber through systems the company did not directly control. The vendor had access to Uber data, the credentials leaked, and the data walked out.

For Uber, the immediate costs are notification letters and regulatory filings. For the drivers named in those filings, the cost runs longer, since a license number does not expire with a news cycle. Expect the confirmed count to grow as remaining states file their notices, and expect Fireworks to face sharper questions about why its tokens guarded so much.