Follow us on Google News
Ride-hailing giant Uber has confirmed that hackers accessed the personal information and driving licence details of thousands of its drivers following a cybersecurity breach at artificial intelligence infrastructure provider Fireworks AI.
Regulatory disclosures reviewed in the United States indicate that at least 7,870 individuals across Massachusetts, South Carolina and Rhode Island have been affected. Additional drivers in California and Illinois were also impacted, although the number of affected individuals in those states has not been disclosed.
The breach occurred in October, but its impact on Uber drivers has emerged through notifications filed with US state authorities this week. The company has begun informing affected individuals and offering assistance to protect them against possible identity theft and financial fraud.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Compromised Credentials Allowed Hackers To Access Uber Data
According to Uber’s notification submitted to the California Attorney General, the security incident occurred on October 7.
On October 9, a technology service provider informed Uber that attackers had obtained internal security credentials and used them to access Uber’s account with the provider.
Uber subsequently disconnected its systems from the affected service and launched an investigation.
By October 13, investigators established that the compromised credentials had been used to access information connected to Uber’s account, including personal information belonging to affected individuals.
The company later confirmed that the technology provider involved was Fireworks AI, a platform that helps businesses and software developers access and operate artificial intelligence models.
The available disclosures identify driving licence information belonging to 3,430 individuals in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island.
Uber has not disclosed the total number of drivers affected nationwide or the complete range of personal information accessed in the incident.
The company also said it had not identified any misuse of the affected information so far.
Fireworks AI Breach Exposes Wider Technology Supply Chain Risks
The incident highlights the risks associated with businesses relying on external technology providers to develop and operate AI-powered services.
Fireworks AI disclosed in October that an attacker had obtained access to internal credentials and information stored within certain customer accounts.
In an updated security bulletin published on November 9, the company confirmed that the incident had also affected customer billing information, account details and certain datasets.
The company disclosed a further security incident involving an external cloud provider that hosted some of its research and development infrastructure.
On October 24, attackers exploited access through that provider to reach Fireworks’ development systems, resulting in additional customer data exposure.
Fireworks has not publicly clarified which of these incidents led to every category of Uber data being accessed.
The AI company has engaged cybersecurity firm Palo Alto Networks Unit 42 to assist with forensic investigations and has notified law enforcement.
Its security measures include replacing compromised credentials, restricting access to sensitive systems and strengthening monitoring capabilities.
The company believes the attackers were financially motivated and interested in obtaining unauthorised access to commercial AI models.
Such activity, sometimes called LLMjacking, involves using stolen credentials to access expensive artificial intelligence computing services without the legitimate account holder’s permission.
However, investigators have not publicly established the specific motive behind the theft of Uber drivers’ personal information.
Stolen Driving Licence Details Raise Identity Fraud Concerns
Driving licences contain sensitive information that can be used to establish an individual’s identity.
Depending on the information available, criminals may attempt to impersonate affected individuals, submit fraudulent applications or persuade victims to disclose additional personal and financial details.
The information could also support targeted phishing attempts against drivers.
For example, fraudsters could pose as Uber support representatives and use genuine personal details to make fraudulent account verification requests appear convincing.
Uber is offering affected individuals complimentary credit monitoring and fraud assistance through Cyberscout, a TransUnion company specialising in identity protection and fraud recovery services.
Recipients must enrol within 90 days of receiving their notification letters.
The company has also advised affected individuals to monitor financial statements, review credit reports and consider placing fraud alerts or security freezes on their credit records.
These precautions are intended to reduce the risk of subsequent fraud rather than indicate that financial accounts have already been compromised.
Earlier Uber Breaches Highlight Continuing Data Protection Challenges
The latest disclosure is not Uber’s first major cybersecurity incident involving driver information.
In its recent regulatory filings, the company acknowledged that a 2016 breach exposed information belonging to approximately 57 million drivers and customers worldwide.
That incident included driving licence numbers belonging to around 600,000 drivers, alongside other personal information.
Uber also experienced a cybersecurity incident in September 2022 in which an attacker gained access to certain internal corporate systems and tools.
The current breach differs because the attackers obtained access through a separate technology provider rather than a confirmed compromise of Uber’s internal corporate network.
For companies operating across multiple countries, including India, the incident raises important questions about how sensitive customer and worker information is shared with external AI services.
There is currently no confirmed evidence that Indian Uber drivers were affected by the Fireworks AI incident. However, the breach demonstrates why businesses must examine whether external technology providers require access to sensitive identity documents and how those records are protected.
What This Means For You:
Uber drivers who receive breach notifications should verify them through official company channels, review their financial accounts and remain cautious about unexpected requests for identity documents or OTPs. Businesses using external AI platforms should restrict access to sensitive personal information and regularly review their vendors’ security practices.
