Uber said in notices filed this week with several U.S. attorneys general, including California’s, that the provider informed it on October 9 that hackers had accessed internal credentials and used them to reach Uber data. The company then began notifying drivers whose personal information was stored with the provider.
TechCrunch identified the provider as Fireworks AI, which gives developers access to open AI models. Fireworks disclosed a breach last month in which hackers stole customer information, including billing data and some private AI datasets. Online productivity startup Notion confirmed that its data was also taken in the Fireworks incident.
“The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,” an Uber spokesperson told TechCrunch, referring questions to Fireworks. Uber has not disclosed how many drivers or customers were affected. A Fireworks spokesperson did not respond to questions.
According to breach notices reviewed by TechCrunch, driver’s license information was stolen from 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. An Illinois filing said residents’ license information was taken but listed the number affected as pending. Uber also notified California drivers, without saying how many were affected. The total is expected to rise as further notices are filed.
Fireworks attributed its breach to a financially motivated cybercriminal group seeking to sell stolen tokens used to access large language models. No known cybercriminal group has claimed responsibility for the data theft. The incident is Uber’s second known breach this year: the company previously reported a security incident at its Uber Freight truck-shipping unit, which an extortion gang claimed involved stolen data.
Comments (0)
No comments yet. Be the first!