Uber says a vendor breach exposed driver license data

Uber is notifying drivers that personal information and driver's license data were stolen in an October breach at a technology vendor. The company said the vendor is Fireworks.ai.

The vendor told Uber on October 9. Notices filed with state attorneys general say the provider reported that day that intruders had taken internal credentials and used them to reach Uber data held with the provider. Uber later said the notices concern a security incident at Fireworks.ai, which had access to some Uber data.

Three states have published counts. Notices list driver's license data for 2,567 people in Massachusetts, 3,430 people in South Carolina, and 1,873 people in Rhode Island. Uber also notified drivers in California and did not publish how many. No nationwide total is in the notices reviewed for this story.

The company has not posted its own account of the breach. The figures come from the state notices and from Uber's statement about the vendor. A separate Illinois count was not in those notices. Fireworks has described its own October incident as access to customer account and billing data, and, for a limited set of accounts, secrets, datasets, and incomplete models.