Uber Notifies Thousands of Drivers After Personal Data Stolen in Third-Party Tech Vendor Breach

Uber is currently notifying thousands of drivers across the United States that their sensitive personal details and driver’s license information were compromised during a data breach. The security incident originated not within Uber’s own primary network, but at one of the ride-hailing giant’s third-party technology providers back in October.

According to regulatory notices filed this week with multiple state attorneys general—including authorities in California—Uber was alerted on October 9 by the vendor that unauthorized actors had breached its systems. The hackers reportedly stole internal administrative credentials, which were subsequently used to gain unauthorized access to stored Uber data. Following the disclosure from the vendor, Uber initiated its response protocol and began issuing notifications to affected drivers whose personal files were housed within the third-party environment.

While Uber has maintained strict confidentiality regarding the exact number of individuals impacted globally or the total volume of driver notifications sent out, state-level data breach filings provide a clearer picture of the localized fallout. Based on disclosure documents reviewed by tech publications, the exposed records heavily feature driver’s license information. Specific filings reveal that leaked records include the driver’s licenses of 2,567 individuals in Massachusetts, 3,430 people across South Carolina, and 1,873 residents of Rhode Island. Meanwhile, an official filing submitted in Illinois confirmed that local state residents were also caught up in the breach, though the state-specific tally remains pending. Uber has similarly begun reaching out to impacted drivers residing in California, though state filings there have yet to disclose a precise head count. Industry analysts and cybersecurity experts expect these figures to climb steadily as additional state-level breach notifications are formally processed and published in the coming weeks.

Although Uber initially withheld the name of the third-party vendor in its early public communications, independent reporting has identified the company as Fireworks AI. Fireworks AI operates as a specialized platform that allows software developers to access, test, and deploy open-source artificial intelligence models. Last month, Fireworks AI itself reported a significant cyberattack in which malicious actors penetrated its infrastructure and exfiltrated customer information. The stolen data spanned critical operational assets, including internal billing records and private AI datasets belonging to corporate clients.

The fallout from the Fireworks AI security incident has extended far beyond the ride-sharing sector. Online productivity startup Notion also confirmed that its corporate data was compromised in the same breach, underscoring the cascading risks associated with centralized third-party artificial intelligence infrastructure and software-as-a-service providers.

When pressed for comment regarding the broader scope of the incident, an Uber spokesperson pointed directly to the vendor relationship. "The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," the spokesperson stated, while deferring all technical inquiries and operational questions back to Fireworks AI. Representatives for Fireworks AI did not respond to multiple requests for comment regarding the breach, the exact vector of the attack, or the total number of corporate customers affected.

Investigations into the underlying mechanics of the Fireworks AI hack point toward a financially motivated cybercriminal syndicate. According to operational briefings from the AI provider, the threat actors’ primary objective appears to be the acquisition and subsequent monetization of stolen authentication tokens. These tokens are valuable commodities on underground cybercrime forums because they grant high-level access to large language models, or LLMs, potentially allowing unauthorized users to hijack valuable computational resources or extract proprietary data. Despite the attribution to a financially driven motive, no prominent cybercriminal organization has publicly stepped forward to claim responsibility for the data theft at Fireworks AI.

This October security incident marks the second known data breach to affect Uber over the course of the year. Earlier, the company faced significant scrutiny when its Uber Freight truck shipping unit was forced to launch a comprehensive internal investigation following claims by a known extortion hacking group that they had successfully breached the division’s network and exfiltrated sensitive corporate data.

As regulatory bodies continue to review the incoming filings from Uber and other affected technology firms, cybersecurity professionals emphasize that supply chain vulnerabilities and third-party vendor access remain among the most difficult attack surfaces for modern enterprises to secure. For the thousands of Uber drivers now receiving notices in their mailboxes and inboxes, the incident highlights the persistent risks of personal data exposure in an increasingly interconnected corporate ecosystem.