Uber says vendor breach at Fireworks AI stole thousands of drivers' license records

What happened

Uber is warning thousands of drivers in the United States that their driver's license details and other personal information were stolen after intruders broke into one of the company's technology suppliers in October. According to TechCrunch, which broke the story, Uber disclosed the incident in notices filed this week with several US state attorneys general, including California.

Uber said the supplier alerted it on October 9, telling the company that hackers had taken internal credentials and used them to reach data belonging to Uber. The ride-hailing firm then began informing affected drivers that their information had been held by that provider.

The supplier was Fireworks AI

TechCrunch identified the provider as Fireworks AI, a platform that gives developers access to open AI models. Fireworks disclosed a breach of its own last month, in which hackers stole customer information including billing records and some private AI datasets. Notion, the workplace software company, has separately confirmed that its data was also taken in the Fireworks intrusion.

An Uber spokesperson told TechCrunch that the driver notices relate to a security incident at the vendor Fireworks.ai, which held a portion of Uber's data, and directed further questions to the supplier. Neither company has said how many people are affected in total. TechCrunch reports that Fireworks did not respond to its questions and that Uber gave no overall figure.

The partial numbers so far

The state filings offer only a rough floor. According to breach notices reviewed by TechCrunch, driver's license information was stolen for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, meaning at least 7,870 individuals across those three states alone. An Illinois filing confirms that residents there were affected but says the count is still pending, and Uber notified California drivers without saying how many. TechCrunch expects the total to rise as more notifications arrive.

On attribution, Fireworks has tied the intrusion to a financially motivated criminal crew interested in selling stolen tokens that grant access to large language models. No known group has publicly claimed the theft, according to TechCrunch.

Uber's second known breach this year

This is Uber's second known data breach of the year, TechCrunch notes. The company previously reported a security incident at Uber Freight, its trucking logistics unit, for which an extortion gang claimed credit for stealing data.

Why it matters

Uber appears to have been compromised without its own systems being broken into: the credentials that opened the door belonged to a supplier. Any organization that shares customer records with outside vendors inherits that vendor's security posture, while regulators still expect the data owner, not the supplier, to notify the people affected.

Driver's license data carries direct identity-theft risk because licenses are widely used for identity verification, so the individuals caught up in this incident face consequences well beyond the initial exposure.

The case also shows that AI infrastructure providers are now firmly part of the breach-notification economy. Fireworks sits between open models and the companies building on them, and a single incident there rippled outward to at least two well-known customers, Uber and Notion. As more enterprises route sensitive data through AI platforms, supply-chain breaches of this kind look set to become a recurring category of disclosure.