Uber confirms thousands of driver IDs compromised in data breach

Uber is notifying thousands of drivers that their personal information and driver's licenses were stolen in a recent data breach.

The rideshare giant confirmed the breach in filings submitted to nationwide attorneys general this month. One of the company's third-party service providers, confirmed by TechCrunch to be Fireworks AI, notified Uber of the hack, which compromised several of its clients' databases.

The hackers accessed billing data and some private AI datasets from a small percentage of Fireworks AI's thousands of clients, according to initial breach notices involving the productivity software Notion. Fireworks AI explained that unnamed cybercriminals, allegedly motivated by a desire to steal and then sell LLM tokens, breached its cloud provider to access its development system. They then used internal credentials to access client data.

Notion confirmed the actors obtained anonymized chat transcripts of Notion AI customers.

Uber requires all drivers to upload proof of a valid driver's license, insurance, and residency, as well as bank statements and payment information. In June, Uber announced additional background checks and expanded policies for reviewing and banning drivers based on public records.

Uber has not confirmed the total number of drivers directly impacted by the breach, but has said it will notify all affected workers. Uber currently operates a fleet of more than 10 million drivers and couriers, according to third-party estimates. As of now, the company has alerted almost 8,000 compromised driver accounts spanning three states: Massachusetts, South Carolina, and Rhode Island.