Uber confirms hackers stole thousands of drivers' license images through AI vendor Fireworks
Uber confirmed November 13 that hackers stole driver's license images and extracted personal data — names, addresses, dates of birth and license numbers — for thousands of drivers through an October breach at its vendor Fireworks AI, which lets developers run open AI models. Attackers used credentials stolen from Fireworks to reach a cloud storage area Uber had set up for the vendor on October 7; Uber was notified October 9 and confirmed the access October 13, according to Uber's November 10 letter to the Iowa Attorney General and its California filing. State filings so far cover about 16,236 people across six states, with no national total given.
📊 Scorecard: our Bearish call on $UBER is scored from $69.69, the last close before it ran. Its first result comes after the next close.
The News
Uber confirmed November 13 that hackers stole driver's license images and extracted personal data — names, addresses, dates of birth and license numbers — for thousands of drivers through an October breach at its vendor Fireworks AI. Fireworks AI lets developers run open AI models; Uber had set up a cloud storage area for the vendor, and attackers used credentials stolen from Fireworks to reach it on October 7. Uber was notified on October 9 and confirmed the access on October 13, according to Uber's November 10 letter to the Iowa Attorney General and its California filing.
State filings so far cover about 16,236 people across six states: Iowa about 2,999, South Carolina 3,430, Massachusetts 2,567, Rhode Island 1,873, Vermont 1,071, per PCMag, and Texas 4,296, the last from a Texas Attorney General filing dated November 13. No national total has been given — those are only the states where filings have been made public so far, so the real total is likely higher. A driver's license image is more sensitive than a password: it carries a government identity document, and the data extracted from it can be used for identity theft.
Fireworks attributed its breach to a financially motivated group seeking LLM access tokens — the keys that let someone use large language models, which are valuable because AI computing is expensive. Notion also confirmed its data was stolen in the same incident. This is a distinct victim and event from the November 14 published post about the Cursor breach: same underlying Fireworks breach, different company and different data. Uber shares closed Friday at $69.69, up 0.82%.
The attackers wanted AI access tokens — what they got was thousands of drivers' government IDs.
Why It Matters
A driver's license is not like a password. It is a government identity document, and once its image and the data on it are stolen, the victim cannot simply reset it. The names, addresses, dates of birth and license numbers taken here can be combined into identity-theft attempts that last for years — opening accounts, passing checks, impersonating the driver. That is why the theft of license images is more serious than the theft of an email list or a set of usernames.
The breach also shows how one vendor can hurt many companies at once. Fireworks AI's stolen credentials were the key: attackers used them to reach Uber's cloud storage area, and the same breach has already affected Cursor and Notion. Each of those companies trusted the same vendor, and each is now dealing with its own incident. The attackers' motive, according to Fireworks, was LLM access tokens — the keys for using large language models, which are valuable because AI computing costs money. The drivers' licenses were collateral: the attackers got in looking for one thing and took what they found.
The numbers so far are only a floor. About 11,940 people across five states have been counted in public filings, but no national total has been given, and filings are still coming in. Uber confirmed the breach on November 13, more than a month after the October 7 access, which is a long time for drivers to have been exposed without knowing. For a company whose business depends on drivers trusting it with their identity documents, that delay and that data are both bad news.
Analyst's Take
Our call is Bearish. The data stolen here is the worst kind: a driver's license image plus the name, address, date of birth and license number extracted from it is a full identity kit. Passwords can be changed; a driver's license number cannot, and the information on it can be used to open accounts, pass identity checks and commit fraud for years. Thousands of drivers now carry that risk because a vendor's credentials were stolen.
The second problem is the pattern. This is the same Fireworks AI breach that already hit Cursor and Notion — one vendor's stolen credentials opening doors at multiple customers. Uber set up the cloud storage area for Fireworks itself, which means the company's own infrastructure was the entry point, reached through a vendor's keys. That is a supply-chain failure, and it is the same failure shape as the Expedia breach reported the same week: the vendor, not the victim's own defences, was the weak point.
Reader poll: what should affected drivers do first? Vote: Freeze my credit, Watch my accounts, or Contact Uber.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is Fireworks AI?
Fireworks AI is a vendor that lets developers run open AI models — the kind of company that provides the computing behind AI features. Uber had set up a cloud storage area for Fireworks, and attackers used credentials stolen from Fireworks to get into that storage area on October 7. Uber was notified on October 9 and confirmed the access on October 13.
What data was stolen?
Driver's license images, plus the personal data extracted from them: names, addresses, dates of birth and license numbers. That is the kind of information that can be used for identity theft, because a driver's license is a government identity document.
How many drivers are affected?
State filings so far cover about 11,940 people across five states: Iowa about 2,999, South Carolina 3,430, Massachusetts 2,567, Rhode Island 1,873 and Vermont 1,071. No national total has been given, so the real number is likely higher — those are only the states where filings have been made public so far.
Is this the same breach as the Cursor story?
Same underlying vendor breach, different victim and data. The November 14 published post covered Cursor, whose data was stolen through the same Fireworks AI breach. This story is about Uber's drivers and their license images — a distinct victim and a distinct set of stolen data, confirmed separately by Uber on November 13.
👁
Source: TechCrunch