Uber says hackers used stolen credentials from a technology provider to access company data containing driver's license information, with breach notices already listing thousands of affected people in at least three states and more expected to come. The company says it was notified on October 9 that an unauthorized party had broken into a provider's systems and used stolen internal credentials to reach Uber's data.
According to The News Tribune, Uber said an unauthorized party used compromised service-provider credentials to access its data, and the company opened an investigation after receiving the October 9 notice. That investigation determined on October 13 that the party had used the credentials to access Uber data, the outlet reported. Uber has since severed its data connections with the provider.
The breach notice sent to affected individuals was dated November 10 and did not identify the provider involved or specify exactly what data had been accessed, per the same report. The accessed data included recipients' personal information, and the notice provided instructions for residents of the District of Columbia, Maryland, North Carolina, New York and Pennsylvania. Uber said it has not identified any misuse of the data to date.
Fireworks AI Named as the Breached Provider
TechCrunch reported that the provider is Fireworks AI, filling in a detail Uber's own notice left out. Fireworks confirmed it had identified a security issue involving unauthorized access to some of its systems, which affected customer data, according to the outlet. TechCrunch also reported that the accessed data included driver's license information, information Uber's notice did not spell out.
The scale of the breach is starting to come into focus through state-by-state filings. TechCrunch reported that notices listed driver's license information stolen for 2,567 individuals in Massachusetts, 3,430 people across South Carolina, and 1,873 residents of Rhode Island. The Rhode Island figure matches what Uber disclosed in its own notice, according to The News Tribune.
Illinois Count Still Pending, California Total Undisclosed
An Illinois filing reviewed by TechCrunch said the number of affected residents there was still pending, and the outlet noted that figure is expected to rise as more breach notifications arrive. Uber also notified drivers who live in California but did not say how many had their information stolen, per TechCrunch. The company has not disclosed how many customers were affected overall or how many drivers it is notifying nationwide.
Uber is offering affected people free credit monitoring and fraud assistance through CyberScout, a TransUnion company, according to The News Tribune. Recipients of the notice have to enroll within 90 days from the letter date to receive that assistance.
Second Known Breach of the Year for Uber
TechCrunch described the incident as Uber's second known data breach this year. A separate security incident at Uber Freight drew a claim of responsibility from an extortion gang, according to TokenPost. That earlier episode is unrelated to the Fireworks AI credential theft but underscores a pattern of third-party access issues the company has faced this year.
The article detailing Uber's notice was reported by Reuters correspondent Akash Sriram from Bengaluru and edited by Tasim Zahid, with Reuters noting it did not receive an immediate response from either Uber or Fireworks AI to its request for comment, per The News Tribune.
