Uber Driver Data Stolen in Fireworks AI Supply-Chain Breach

Uber breach notices list stolen driver’s-license data for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island.

That is the clearest public measure of a supply-chain breach centered on Fireworks AI, a provider whose stolen internal credentials gave hackers access to some Uber data. Uber is notifying thousands of drivers, though the company has not released an overall victim count.

The paper trail runs through several U.S. attorneys general’s offices, where Uber filed breach notices this week, TechCrunch reported. Uber says the theft occurred during an October breach at the provider. TechCrunch identified that provider as Fireworks AI.

For the drivers named in the notices, the exposure runs through a technology vendor. Uber said their personal information had been stored with the provider and was taken after hackers entered its systems.

The episode carries stakes beyond stolen licenses. Fireworks reported losses involving billing data and private AI datasets, and Notion confirmed that its data was stolen in the same hack.

The facts make vendor access a central issue for AI security. TechCrunch described Fireworks as a provider that lets developers access and use open AI models. The breach reached Uber’s driver records and Notion’s data, while Fireworks also lost customer datasets.

How did the breach move from Fireworks into Uber’s data?

Uber said it learned of the compromise on October 9. The notice came from the provider, which reported that hackers had broken in and stolen internal credentials. Those credentials were then used to access Uber’s data, according to the ride-hailing company.

Uber filed notices with several U.S. attorneys general that week, including California, TechCrunch reported. Those filings connect the vendor intrusion to state-level privacy notifications for affected drivers.

TechCrunch identified the provider as Fireworks AI. The company lets developers access and use open AI models, placing it in the infrastructure layer between model builders and organizations that build on those models.

Fireworks reported its own breach last month. Hackers stole customer information, including billing data and some private AI datasets, according to the company’s account of the incident.

The same incident reached another customer. Online productivity startup Notion confirmed that its data was also stolen in the Fireworks hack.

An Uber spokesperson told TechCrunch: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.”

The spokesperson deferred TechCrunch’s questions to Fireworks. A Fireworks spokesperson did not respond to questions about the incident, leaving the provider without a public answer to the outlet.

The public record therefore combines three accounts. Uber has explained the vendor link and begun driver notifications. Fireworks has described a cybercriminal breach involving customer information. Notion has confirmed its own exposure.

What information was exposed to drivers?

The state-by-state notices provide the firmest numbers available. TechCrunch saw Uber’s breach notices specifying stolen driver’s licenses for:

• Uber’s Massachusetts notice identifies 2,567 individuals with stolen driver’s licenses.
• Uber’s South Carolina notice covers 3,430 people.
• Uber’s Rhode Island notice lists 1,873 residents.

Those three headline counts total 7,870 people. That is not a final total, because Uber has not said how many drivers it is notifying and more breach notifications are expected to increase the number.

An Illinois filing showed that some state residents’ driver’s-license information was stolen. The number of affected people remained pending in that filing.

Uber also notified drivers who live in California. The company did not say how many of them had information stolen, so California adds an unknown number of people to the public record.

Uber did not disclose how many customers were affected or how many drivers it was notifying. The company also has not released a consolidated figure that combines the known states with drivers who may receive later notices.

The notices identify personal information and driver’s-license information as the exposed categories. They do not provide a driver-by-driver account, and the three published state counts remain the firmest measure of the incident’s reach.

Each additional filing can add drivers and locations to the record. Uber expects the reported number to rise as more data-breach notifications roll in, making the sequence of state filings the main path to a fuller count.

Who was behind the intrusion?

Fireworks attributed the breach to a financially motivated cybercriminal group. The company said the group’s goal was to sell stolen tokens for accessing large language models, or LLMs.

That stated objective points toward resale of model access rather than public disruption, according to Fireworks’ account. The stolen material could therefore create value outside the systems from which it was taken.

No known cybercriminal group has taken credit for the data theft, TechCrunch reported. The company has described a financial motive without naming the organization or individuals responsible.

A public claim could give victims a named culprit and a clearer target for accountability. Motive alone leaves the actor unidentified.

The breach therefore has a commercial theory but no public ownership. Fireworks has not named the group, and no known group has acknowledged the theft. That gap leaves responsibility publicly unclaimed even as the affected companies disclose the damage.

Why does an AI vendor matter here?

Fireworks’ role gives the incident broader relevance than a ride-hailing data leak. TechCrunch described the company as a service that lets developers access and use open AI models. Uber said the vendor had access to some of its data.

The stolen credentials then connected that model-access role to Uber’s driver records. Fireworks separately said the theft included customer billing data and private AI datasets.

For enterprise buyers, the sequence TechCrunch reported shows one provider breach reaching at least Uber’s driver data and Notion’s data. Fireworks also lost customer billing information and private AI datasets in the same incident.

That concentration makes Fireworks’ internal credential controls relevant to every downstream customer in the disclosed chain. A single vendor compromise could affect several organizations without each company operating the breached service itself.

The policy stake sits in cross-company accountability. Uber has filed state notices. Fireworks has described the breach. Notion has confirmed its exposure. Each company occupies a different part of the chain, but the public disclosures do not assign a complete account of responsibility among them.

The known customer set may also be incomplete. Fireworks reported a broader breach involving its customers, while the current report names Uber and confirms Notion’s involvement. The public record does not quantify the full customer impact.

Is this Uber’s second breach this year?

Yes. According to TechCrunch, this is Uber’s second known data breach this year.

The first involved the company’s Uber Freight truck-shipping unit. An extortion gang took credit for stealing data in that security incident, unlike the Fireworks case, where no known cybercriminal group has claimed responsibility.

The contrast reflects different public postures. The earlier incident produced a public claim and an extortion narrative. The later case has a described financial motive and detailed driver counts in three states, but no group claiming the theft.

For customers, that difference leaves two kinds of uncertainty. The Uber Freight breach has a self-identified criminal actor. The Fireworks case has named victims and state filings, but Fireworks has not explained the mechanics of the credential theft in its response to TechCrunch.

The current incident adds more detailed public disclosure about affected people. It also adds a new dimension: a technology provider serving AI developers became the route to data held by ride-hailing drivers and other Fireworks customers.

What happens next?

The reported number is expected to rise. More data-breach notifications are still rolling in, and Uber expects those disclosures to increase the count beyond the figures named so far.

TechCrunch’s reporting leaves several gaps:

• Uber has not said how many drivers it is notifying or how many customers were affected.
• The Illinois filing lists the affected-person count as pending.
• Uber did not disclose how many California residents had information stolen.
• A Fireworks spokesperson did not respond to TechCrunch’s questions.
• TechCrunch reported that no known cybercriminal group had claimed the theft.

Those gaps limit any final accounting. A count based only on Massachusetts, South Carolina and Rhode Island captures 7,870 people, while the notices for Illinois and California could raise it.

The breach also extends beyond driver records. Fireworks said customer billing information and some private AI datasets were taken, and Notion confirmed that its data was stolen.

The next wave of notifications should establish whether Uber’s total climbs beyond the 7,870 people already documented in three states. Fireworks has not answered TechCrunch’s questions, and no known criminal group has claimed the theft. Those gaps leave the full scale of the vendor breach and the mechanics of the credential theft unresolved.