Uber is notifying thousands of drivers across the United States that their personal information, including sensitive driver’s license data, was compromised during a security breach at Fireworks AI, a third-party technology provider utilized by the ride-hailing giant. The incident, which occurred in October, highlights the growing vulnerability of corporate data ecosystems as companies increasingly rely on external artificial intelligence platforms and specialized tech vendors. According to regulatory filings submitted to several state attorneys general this week, Uber was informed of the unauthorized access on October 9, 2024, after hackers successfully breached Fireworks AI’s internal systems to exfiltrate credentials and customer datasets.
The Mechanics of the Fireworks AI Breach
Fireworks AI is a specialized platform that provides developers with infrastructure to run and customize open-source large language models (LLMs). Because many modern tech companies, including Uber and the productivity startup Notion, integrate AI into their internal workflows or customer-facing products, they often share specific datasets with providers like Fireworks AI to facilitate model training or inference.
The breach at Fireworks AI was characterized as a targeted intrusion by a financially motivated cybercriminal group. According to the provider, the primary objective of the attackers appeared to be the theft of "tokens"—digital keys that allow users to access and utilize expensive AI computing resources. However, in the process of harvesting these tokens, the hackers gained access to broader customer databases. This included billing information, private AI datasets, and, in Uber’s case, files containing the personal identification details of its contract drivers.
While Fireworks AI has confirmed it identified "unauthorized access to some of its systems," the company has been reticent to provide specific details regarding the total volume of data lost or the exact methods used by the attackers. The incident has already claimed other high-profile victims; Notion, a popular online collaboration tool, recently confirmed that its data, including some customer chat transcripts, was also exposed during the same Fireworks AI intrusion.
Geographic Scope and Impacted Driver Statistics
The full scale of the breach remains a moving target as Uber continues to file mandatory disclosure reports with state regulators. Current data breach notices provide a fragmented but concerning picture of the number of drivers affected across various jurisdictions.
In Massachusetts, Uber reported that the driver’s licenses of 2,567 individuals were stolen. In South Carolina, the number rose to 3,430 drivers, while Rhode Island saw 1,873 residents impacted. Filings in Illinois confirmed that residents were affected, though the specific headcount is still listed as "pending" as the investigation continues. California, Uber’s home state and one of its largest markets, also received a notification, though the ride-hail giant has not yet publicly disclosed the specific number of California-based drivers whose data was exfiltrated.
Security analysts expect these numbers to rise significantly as more state-level disclosures are processed. Under U.S. law, companies are required to notify state attorneys general when a certain threshold of residents is affected by a data breach, but the timeline for these filings can vary based on the complexity of the forensic audit.
A Chronology of the Incident
The timeline of the breach reveals a gap between the initial intrusion and the subsequent notification of the victims, a common occurrence in complex supply chain attacks.
- Early October 2024: Hackers gain unauthorized access to Fireworks AI’s internal infrastructure.
- October 9, 2024: Fireworks AI detects the breach and notifies its corporate clients, including Uber, that their data may have been accessed.
- Late October 2024: Fireworks AI publicly acknowledges a security issue involving customer information and billing data.
- November 2024: Uber completes its internal review to identify which specific drivers had their information stored on the compromised Fireworks AI systems.
- Mid-November 2024: Uber begins filing formal notices with state attorneys general and sending individual letters or emails to affected drivers.
In its communication with drivers, Uber clarified that the breach did not occur on Uber’s own internal servers, but rather on the systems of its vendor. An Uber spokesperson emphasized that the company is working closely with Fireworks AI to understand the extent of the lapse, while deferring specific technical questions to the provider.
The Rising Threat of Supply Chain Vulnerabilities
The Uber-Fireworks AI incident is a textbook example of a "supply chain attack," a cybersecurity phenomenon where hackers target a smaller, third-party vendor to gain access to the data of much larger, more secure organizations. For a company like Uber, which maintains robust internal security protocols, the primary risk often lies in the "peripheral" companies that handle its data for specialized tasks like AI processing, payroll, or cloud storage.
This trend has accelerated with the rapid adoption of generative AI. As corporations rush to integrate LLMs into their business models, they are increasingly sharing proprietary data with AI startups that may not yet have the same level of security maturity as established tech titans. In this case, the attackers’ interest in "tokens" highlights a new frontier in cybercrime: the theft of AI compute power, which can be sold on the dark web or used to run resource-intensive malicious operations.
Uber’s Troubled Cybersecurity History
This latest incident marks the second major data breach for Uber in 2024 alone. Earlier this year, the company’s Uber Freight division—a unit focused on truck shipping and logistics—was targeted by an extortion group that claimed to have stolen sensitive corporate and shipment data.
Uber’s history with data security has been fraught with high-profile controversies. In 2016, the company suffered a massive breach involving the data of 57 million users and drivers. Rather than disclosing the incident, Uber’s then-security leadership paid the hackers $100,000 to delete the data and keep the breach quiet. This cover-up eventually led to federal investigations and the landmark criminal conviction of Uber’s former Chief Security Officer, Joe Sullivan, for obstruction of justice.
In 2022, Uber was hit again, this time by a teenager associated with the Lapsus$ hacking group. That attacker used social engineering to bypass multi-factor authentication (MFA), gaining access to Uber’s internal Slack channels and cloud infrastructure. While Uber has made significant investments in security since these incidents, the Fireworks AI breach demonstrates that even with improved internal defenses, the reliance on third-party vendors remains a critical "blind spot."
Implications for Drivers and Identity Theft Risks
The theft of driver’s license information is particularly concerning for the affected individuals. Unlike a credit card number, which can be easily changed, a driver’s license is a foundational piece of identity. In the hands of cybercriminals, this information can be used to open fraudulent bank accounts, apply for loans, or create "synthetic identities" for other criminal activities.
Furthermore, driver’s license data is highly valued on dark web marketplaces because it can be used to bypass "Know Your Customer" (KYC) verification processes on cryptocurrency exchanges and other financial platforms. Drivers whose information was compromised are now at a heightened risk of targeted phishing attacks, where scammers may use the stolen details to appear legitimate and trick victims into revealing further sensitive information, such as Social Security numbers or banking credentials.
Uber has stated it is providing affected drivers with resources to monitor their credit, though the company has not specified the duration of these services. Security experts generally recommend that victims of such breaches place a "security freeze" on their credit reports to prevent unauthorized accounts from being opened in their names.
Analysis: The Future of AI Data Governance
The breach at Fireworks AI serves as a cautionary tale for the burgeoning AI industry. As AI providers become central repositories for corporate data, they also become high-value targets for state-sponsored actors and financially motivated gangs. The fact that the attackers were specifically looking for LLM tokens suggests a shift in hacker priorities toward "compute theft," reflecting the high market value of AI processing time.
From a regulatory perspective, this incident may trigger closer scrutiny of how AI companies handle data. Lawmakers in California and the European Union are already considering stricter "data residency" and security requirements for AI model providers. For Uber, the challenge will be to tighten its vendor management protocols, ensuring that third-party partners like Fireworks AI meet the same stringent security standards that Uber applies to its own internal infrastructure.
As the investigation continues, the focus will remain on the total number of victims and whether the stolen data has already begun appearing on illicit forums. For now, thousands of Uber drivers are left to navigate the fallout of a breach that occurred miles away from Uber’s own servers, but which nevertheless puts their personal identities at significant risk.
