Uber drivers' information stolen in a third-party hack

MOZCO/Shutterstock

Uber has revealed in a filing with several attorneys general that the personal information and licenses of thousands of its drivers were compromised in a data breach. In the filing, which shows the notices it sent its drivers about the breach, Uber said that one of its service providers had been hacked on October 9. The attackers stole internal credentials, which they then used to access Uber's data connected to that provider. 

The company told TechCrunch that the third-party vendor involved in the incident was Fireworks.ai, a cloud platform that gives its clients access to open-source AI models. Fireworks admitted that it suffered a data breach last month and that the incident had compromised its clients' data. It attributed the hack to attackers that belong to a cybercriminal group, which sells stolen tokens used to access large language models. It's unclear if the stolen information was also sold or leaked online.

Neither company has revealed how many drivers were affected. According to TechCrunch, though, the driver's licenses of 3,430 people from South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island were exposed in the incident.