The Fireworks AI Hack Has Reached Uber: Thousands of Drivers' Licences Stolen, and the Number Is Only Going Up

Uber is sending notices to thousands of drivers that their personal data and driving licences were stolen in October. Uber itself wasn't breached - one of its tech suppliers was: Fireworks AI, a company that gives developers access to open AI models. The same attack has already taken data from Notion too.

According to filings with the attorneys general of several US states, including California, Fireworks notified Uber on 9 October: hackers had stolen internal login credentials and used them to reach Uber's data. So far the numbers are 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. Illinois is still counting the damage, and for California Uber won't say how many. That's nearly 8,000 driving licences in just three states, and the figure will grow with every new filing.

Uber said the notices relate to "a security incident at one of our third-party vendors, Fireworks.ai, which had access to some Uber data", and passed all further questions on to Fireworks. There, they confirmed unauthorised access to some systems that affected customer data - and left it at that. How many people are affected in total, Uber won't say.

Fireworks blames the attack on a financially motivated criminal group that sells stolen access tokens for large language models. No group has claimed responsibility so far. For Uber this is the second known breach this year: earlier, an extortion gang claimed it had stolen data from its freight division, Uber Freight.

The pattern is familiar. You hand your data to one company, it shares it with a second one, and the second one loses it. Did the driver who scanned their licence to drive for Uber know it would also end up with an AI model company? And how many of the apps we use every day have a supplier we'll never hear about - until the letter arrives saying our data has been stolen?