TL;DR
Uber says a service provider alerted it on October 9 that compromised internal credentials had been used to access Uber data held by the provider. Uber later identified the vendor as Fireworks AI; TechCrunch reports the stolen data included driver’s license information. Notices describe about 7,870 affected residents across three states, but no national total is available.
In a notice dated November 10 and filed with the California attorney general, Uber said a service provider told the company on October 9 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber said it cut its data connections with the provider and opened an investigation. By October 13, the investigation had found that Uber data connected to the service provider had been accessed.
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The California filing does not name the provider, and its public sample letter leaves the field describing affected personal information blank. Uber identified Fireworks AI in a statement to TechCrunch. The outlet reported that breach notices it reviewed said the stolen information included driver’s license data. The individual letter is the source Uber directs each recipient to for details about which personal information was involved.
Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported counts of 2,567 in Massachusetts and 3,430 in South Carolina. Those figures add up to 7,870 people across the three states, but they do not establish a nationwide total. Uber is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must occur within 90 days of the date on the recipient’s letter.
Why License Data Raises Concern
A driver’s license number is a persistent identifier that can be difficult to replace, and its exposure may increase the risk of identity fraud or attempts to impersonate the affected person. Uber’s notice offers credit monitoring and fraud assistance, but recipients may need to take additional steps if they see suspicious activity or believe their identity has been misused.
The incident also shows how personal information can be exposed through a company’s service provider. Uber says the compromised credentials were used to access its account with the vendor. The notice describes access to data connected to that account; it does not say that Uber’s own systems were breached. For drivers, the practical question is which fields were involved in their case, a detail the public sample notice does not provide.
Popular right now
Vitamix 5200 Blender with 64 oz Container, Black
Dyson V15 Detect Cordless Vacuum
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
As an affiliate, we earn on qualifying purchases.
How the Vendor Connection Was Exposed
Fireworks AI provides a platform businesses use to run and customize open AI models. Uber’s filing refers only to a service provider. The company identified Fireworks to TechCrunch, and a Fireworks spokesperson told the outlet the company had found unauthorized access to some of its systems affecting customer data.
Fireworks’ security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time, and that an unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7. Uber’s notice gives October 7 as the breach date in its California filing, says the vendor alerted Uber on October 9, and records that Uber found its data had been accessed on October 13. These are separate milestones in the response, not conflicting descriptions of a single notification date.
Reuters, which also reviewed Uber’s California filing, reported that the notice did not name the provider or list the data involved. TechCrunch later reported the vendor’s name and the reported license-data exposure. The distinction matters: the regulatory notice confirms access to Uber data, while the specific data type comes from breach notices reviewed by the news outlet.
““Uber has not identified any misuse of your data to date.””
— Uber, in its notice to affected people
What the Notices Do Not Establish
The available information does not establish how many people were affected nationwide, whether residents outside Rhode Island, Massachusetts and South Carolina received notices, or exactly which data fields were accessed for each recipient. Uber’s sample notice leaves that information blank; affected people should check their own letter.
Uber says it has not identified misuse to date, but the public material does not explain how long the unauthorized party had access, whether the data was copied or shared further, or what it may have been used for. Neither Uber’s notice nor the information cited here identifies the unauthorized third party or establishes its motive.
Check the Letter and Enroll
People who receive an Uber security notice should use their own letter to confirm which information was involved and follow its instructions to enroll in free Cyberscout monitoring and fraud assistance. Uber says enrollment must be completed within 90 days of the letter date. Recipients can also review their financial and identity records for activity they do not recognize and use the fraud assistance offered in the notice if they have concerns.
Further details may come from additional notices, updated company statements or regulatory filings. Until those are available, the reported three-state counts should not be treated as a complete total, and the exact impact for any individual recipient depends on the information listed in that person’s letter.
Key Questions
What happened to Uber’s data?
Uber says compromised internal credentials at a service provider were used to access Uber data connected to its account with that provider. Uber later identified the vendor as Fireworks AI.
Was driver’s license information exposed?
TechCrunch reported that breach notices it reviewed included driver’s license information. Uber’s public sample notice leaves the affected-data field blank, so recipients should check their own letters for the specific information involved.
How many people were affected?
The available figures are about 1,873 Rhode Island residents, 2,567 in Massachusetts and 3,430 in South Carolina. Together, those figures total 7,870 across three states. A nationwide total has not been established.
What should a recipient do?
Read the letter to identify the data involved and follow its instructions to enroll in the offered free credit monitoring and fraud assistance. Uber says enrollment must happen within 90 days of the letter date.
Has Uber found that anyone misused the data?
Uber says it has not identified misuse to date. The company’s statement does not establish whether misuse may be discovered later.
Source: Thorsten Meyer AI
