Uber is notifying thousands of its drivers that their personal information, including driver’s license data, was stolen after hackers broke into one of the company’s outside technology vendors.
A notice dated Nov. 10 and posted on the California attorney general’s website says an unauthorized party used stolen login credentials belonging to a service provider to get into Uber data. The provider told Uber on Oct. 9 that its credentials had been compromised and used to access Uber’s account with that provider. Uber said it cut off its data connections with the vendor and opened an investigation. By Oct. 13, the investigation had confirmed that the intruders got into Uber data, including the personal information of the drivers now being notified.
The notice did not name the vendor. TechCrunch later identified it as Fireworks AI, an artificial intelligence cloud company.
“The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,” an Uber spokesperson told the outlet.
Fireworks did not respond to questions about the incident.
State filings give a sense of how far the damage could reach. The stolen data includes the driver’s licenses of 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. An Illinois filing showed some state residents were affected but listed the total as pending. Uber also notified drivers in California without saying how many. The final count is expected to rise as more state notices come in.
Uber said it has not found any misuse of the stolen information so far, and no known cybercriminal group has claimed responsibility. Fireworks has blamed the breach on a financially motivated hacking group that aims to sell stolen tokens used to access large language models.
The incident is a stark reminder that a company’s data is only as secure as the weakest link in its supply chain. The hackers never had to break into Uber itself. They went through a partner that held the keys.
For drivers, many of whom are independent contractors who must hand over license information just to work on the platform, the breach is another unwelcome headache.
It is also Uber’s second known data breach this year. Earlier, the company reported a security incident at its Uber Freight trucking unit, and an extortion gang took credit for stealing data.
Uber’s record on data security has drawn scrutiny before. In late 2016, hackers stole the personal data of about 57 million riders and drivers worldwide, including the names and driver’s license numbers of about 600,000 U.S. drivers. Reports at the time said the company kept that breach quiet for more than a year and paid the hackers $100,000 to delete the data. New CEO Dara Khosrowshahi disclosed the breach in 2017.
“None of this should have happened, and I will not make excuses for it,” Khosrowshahi said then.
Now, nearly a decade later, Uber drivers are once again being told that hackers got their sensitive information.
[READ MORE: ‘Put Down the Crack Pipe’: Sen. John Kennedy Rips Vance for Blaming GOP Midterm Rout on Iran War]
