Hackers stole personal information, including driver's license details, for thousands of Uber drivers after breaking into the account of an artificial intelligence provider the company used.
Uber learned of the attack on October 9, when Fireworks AI, a startup that helps developers access open AI models, reported that its internal credentials had been stolen and used to enter Uber's account. By October 13 the company had confirmed the hackers reached its data, including driver personal information. The exposure covers at least 7,870 people across three states: 1,873 in Rhode Island, 3,430 in South Carolina, and 2,567 in Massachusetts.
Fireworks disclosed its own breach in October, saying the attackers took customer account and billing information, datasets, and unfinished AI models from a limited number of accounts, and reached its development machines through a separate incident at one of its cloud providers. The evidence points to a financially motivated cybercriminal group behind a scheme known as LLMJacking, in which stolen credentials are used to tap AI models or resold to others, leaving victims with enormous bills.
Uber severed its data connections with Fireworks as soon as it learned of the breach, and no misuse of the stolen information has been identified so far. Affected drivers get free credit monitoring and fraud assistance through Cyberscout, with 90 days from the date of their notification letter to enroll.