Hackers Stole Thousands of Uber Drivers’ Data Through an AI Startup

The personal information of thousands of Uber drivers has been compromised by hackers. The ride-hailing company recently filed security breach notices with several state attorneys general detailing the incident. According to a notice dated Nov. 10 filed with California’s attorney general, a third-party service provider notified Uber on October 9 that hackers had stolen its internal credentials and used them to access Uber’s account with the provider. On October 13, Uber determined that the hackers had accessed its data, including personal information belonging to drivers. TechCrunch reports that the stolen data included driver’s license information. Uber has not disclosed how many drivers were affected nationwide, but state notices provide some idea of the scope of the breach. The California notice letters state that approximately 1,873 Rhode Island residents were affected. South Carolina’s Department of Consumer Affairs lists another 3,430 affected residents. Meanwhile, TechCrunch reports, citing notices it reviewed, that 2,567 people in Massachusetts also had their information stolen. That brings the total to at least 7,870 people across just three states. Uber confirmed to Gizmodo in an emailed statement that the compromised provider was Fireworks AI, a startup that helps developers access and use open AI models. Fireworks first disclosed its own breach in October but provided an update earlier this week. The company said hackers had accessed customer account and billing information, as well as datasets and incomplete AI models belonging to a limited number of accounts. It also disclosed that hackers had gained access to its development machines through a separate security incident involving one of its cloud providers, exposing additional customer data. Fireworks said it notified law enforcement and has been working with cybersecurity firm Palo Alto Networks’ Unit 42 to conduct forensic analysis. The company says the evidence points to a financially motivated cybercriminal group involved in a practice known as “LLMJacking.” This involves hackers stealing credentials to gain unauthorized access to AI models, then using that access themselves or selling it to others, potentially leaving the victims with enormous bills. The productivity app Notion also confirmed that some of its customers’ data was exposed in the Fireworks breach, including AI chat transcripts. Notion said fewer than 1% of its workspaces were affected. Fireworks did not immediately respond to Gizmodo’s request for comment. As for Uber, the company said it immediately cut off its data connections with Fireworks after learning of the breach. In its California notification letter, Uber said it has not identified any misuse of the stolen information so far. However, it is recommending that affected drivers regularly review their account statements and monitor their credit reports for suspicious activity. Uber is also offering affected drivers free credit monitoring and fraud assistance through Cyberscout. Drivers have 90 days from the date of their notification letter to sign up. Uber also dealt with a security incident in August, when a hacking group claimed to have stolen nearly 1 million files from Uber Freight, the company’s logistics subsidiary. Uber Freight confirmed that attackers had gained unauthorized access to some of its systems but did not verify the hackers’ claims about the files.