Hackers Stole Uber Drivers' License Data Through an AI Vendor. Here Is What Drivers Should Know

Uber is warning thousands of its drivers that their personal information, including driver's license details, was stolen after hackers broke into one of the company's technology vendors, an artificial intelligence firm called Fireworks AI, TechCrunch reported Friday.

The ride-hailing company disclosed the incident in a notice dated Nov. 10 and posted by the California attorney general's office, Reuters reported. According to that notice, the vendor told Uber on Oct. 9 that credentials had been compromised and used to get into Uber's account with the provider. Uber's investigation later found that the intruder had used that access to reach Uber data, including the personal information of the people now receiving letters.

The notice itself did not name the vendor. TechCrunch identified it as Fireworks AI, a company that gives software developers access to open AI models, and an Uber spokesperson confirmed the incident involved one of its third-party vendors, Fireworks, which had access to some Uber data.

Uber has not said how many people were hit in total. Breach notices reviewed by TechCrunch show driver's license information belonging to 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. A filing in Illinois showed that residents there were also affected, with the count still pending, and Uber notified drivers in California without saying how many. The Hill noted that the company's notice to California officials described an unauthorized third party improperly accessing its data.

Uber said it cut off its data connections with the vendor, opened an investigation and has not found any misuse of the stolen information so far, according to Reuters. The company is offering those affected free credit monitoring and fraud help through Cyberscout, a TransUnion company.

For drivers, the practical steps are straightforward. Anyone who receives a letter should enroll in the free monitoring offered before the deadline in the notice, watch bank and credit statements closely, and consider placing a free credit freeze with the three major credit bureaus. Be especially wary of calls, texts or emails that claim to be from Uber and ask for passwords or payment details. Criminals who hold stolen license data often use it to make their scams sound believable.

The bigger story is how the data was taken. This was not a break-in at Uber's own front door. It came through a fast-growing AI supplier that Uber had trusted with some of its information.

Fireworks itself has been disclosing an expanding breach for weeks. The company said it found unauthorized use of internal credentials on Oct. 6, and later reported that an attacker used an incident at an unnamed cloud provider to reach its development machines on Oct. 23 and 24, according to The Hacker News. In an update on Nov. 9, Fireworks said intruders had reached account and billing information and, for a limited group of customers, stored secrets, datasets and partial model weights. The productivity company Notion said the exposed material included AI chat transcripts tied to one of its features. Fireworks has not said how many customers were affected or named the cloud provider.

That chain of events should concern every American who uses an app. Big Tech companies are racing to wire artificial intelligence into nearly everything they do, and much of that work runs through outside vendors. Every new partner that receives customer or worker data is one more door a criminal can try. When the weak point is a supplier most people have never heard of, the people whose information was taken often learn about it weeks after the fact, by letter.

Uber also carries a history here. Hackers stole data on about 57 million riders and drivers in 2016, including roughly 600,000 U.S. driver's license numbers, and the company's former security chief, Joe Sullivan, was convicted in 2022 of obstructing justice and hiding the breach from federal regulators, Fortune reported. Today's leadership disclosed this incident through state breach-notice channels, which is how the law is supposed to work.

The questions now are about scale and accountability. Uber has not released a nationwide count, and the Illinois filing is still pending, so the number of drivers affected could grow as more states post their notices. A Fireworks spokesperson did not answer TechCrunch's questions about the incident, and the company has not said how many of its customers were affected.

For lawmakers, the episode is a case study in why rules on data sharing matter as much as rules on the AI models themselves. A sensible, conservative approach does not require a new federal bureaucracy. It starts with a simple principle that most families already understand: companies should collect only what they need, share it only with partners that can protect it, and tell the people affected quickly and plainly when something goes wrong.

Uber's drivers are working men and women who hand over their license, their identity and their time to earn a living. They deserve at least the same care the company gives its riders. Liberty Bell Report will follow the investigation as more states publish their notices.