Uber is warning thousands of drivers that hackers stole their driver's licence details, TechCrunch reported on 13 November. Uber told several U.S. attorneys general, California among them, that a tech provider alerted it on October 9. Per Uber's notices, hackers took internal credentials and used them to reach Uber's data. TechCrunch learned the provider is Fireworks AI, which gives developers access to open AI models.
Notices seen by TechCrunch list licences of 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. Illinois has a filing with the count pending, and Uber gave California no number. Uber has not said how many drivers it is notifying. Fireworks confirmed unauthorised access to some systems but left questions unanswered. It blamed a money-driven criminal group that wants to sell stolen tokens for LLM access. No group has claimed the theft. TechCrunch does not say whose credentials were taken.
Fireworks says the attackers wanted to sell LLM access, yet driver records held for Uber were reached. A credential is a digital key: it opens whatever its owner may open. So one vendor's stolen keys can lead to many customers' data. Buyers of AI services should ask each vendor what customer data it holds and why, and how its credentials are limited and renewed.