Uber says hackers used stolen login details to access data through its AI vendor Fireworks AI and obtained drivers’ personal information, including license details, for at least 7,870 people in three states, though the nationwide total is not yet known.
In a breach notice dated November 10, Uber said Fireworks alerted it on October 9 that login details had been accessed without permission. Uber’s investigation confirmed on October 13 that its data had been accessed. The company cut its data connections with the provider.
Uber later confirmed that Fireworks AI was the vendor involved. State notices reviewed by TechCrunch list license information among the records that were exposed. The filings list 2,567 affected people in Massachusetts, 3,430 in South Carolina and about 1,873 in Rhode Island.
These figures are not a nationwide count. Illinois notices say the number of affected people is still pending. Uber has not provided a figure for California.
The notices also cover other states. Uber is offering affected people free credit monitoring and help with fraud through Cyberscout, a TransUnion company. People who received a notice have 90 days from its date to sign up.
Uber says it had not identified any misuse of the accessed data as of the date of its notice. Fireworks separately reported unauthorized access affecting some customer information. That broader disclosure does not show that those other types of data were part of Uber’s exposed records.