Uber Drivers' Data Exposed in Third-Party Hack

Uber has revealed in a filing with several attorneys general that the personal information and licenses of thousands of its drivers were compromised in a data breach. The filing shows the notices Uber sent to drivers about the breach. Uber said one of its service providers was hacked on October 9, and attackers used stolen internal credentials to access Uber data connected to that provider.

What Uber Disclosed

Uber told TechCrunch that the third-party vendor involved in the incident was Fireworks.ai, a cloud platform that gives its clients access to open-source AI models. The company said attackers stole internal credentials, which they then used to access Uber's data connected to that provider.

Fireworks.ai Breach

Fireworks.ai admitted that it suffered a data breach last month and that the incident had compromised its clients' data. It attributed the hack to attackers that belong to a cybercriminal group, which sells stolen tokens used to access large language models. It is unclear if the stolen information was also sold or leaked online.

Affected Drivers

Neither company has revealed how many drivers were affected. According to TechCrunch, the driver's licenses of 3,430 people from South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island were exposed in the incident. Uber said the personal information and licenses of thousands of its drivers were compromised.

Sources: Engadget