Uber warns that hackers stole personal and driver’s license details from thousands of drivers through a breach at its AI vendor Fireworks AI, marking the second major Uber-related breach this year.
- Hackers accessed Uber driver license data via Fireworks AI breach
- Approximately 7,870 affected drivers disclosed in several states
- Attack linked to criminal group profiting from stolen AI credentials
What happened
In early October, hackers stole internal credentials from Fireworks AI, an AI platform connected to Uber, enabling unauthorized access to Uber driver data. The compromised information includes personal details and driver’s license information. State attorneys general filings indicate at least 7,870 affected Uber drivers in Massachusetts, South Carolina, and Rhode Island, with additional notifications sent in California and Illinois, suggesting the total number could be higher.
Fireworks AI disclosed two separate October security incidents: one involving stolen internal credentials and another related to a breach at a cloud provider granting attackers access to development systems. Beyond Uber data, attackers reportedly took billing data and sensitive datasets, including unfinished AI model weights. The incident represents a serious breach of trust for Uber’s vendor relationships.
Why it matters
This breach highlights the risks associated with data sharing between large companies and third-party AI service providers. Uber’s reliance on Fireworks AI for certain operational services created a vulnerability that was exploited to access sensitive personal information. The incident raises broader concerns about the security of data handled by AI vendors, especially as AI platforms gain access to critical business and personal data.
Fireworks AI, valued at $17.5 billion in July, is a major player in the AI market, selling developers access to open AI models. The attack demonstrates growing threats to AI infrastructure identified as ‘LLMjacking,’ where criminals steal and commoditize AI credentials to facilitate illicit access. These emerging cybercriminal tactics have broad implications for data privacy and cybersecurity in the AI sector.
What to watch next
Uber and Fireworks AI responses will be critical in mitigating the damage and preventing similar breaches. Monitoring further disclosures about the scope of exposed data and exact numbers of affected individuals will be key as state notifications continue. How Fireworks addresses vulnerabilities in its vendor and cloud environments will also be closely watched by the industry.
Regulatory scrutiny on data practices involving AI vendors may intensify following this and other recent incidents, including Uber’s August Uber Freight breach. Enterprises and AI providers may face increased pressure to adopt robust security measures and transparency relating to data custody and AI infrastructure access, particularly as AI adoption accelerates across sectors.