Uber is notifying hundreds of drivers that their private and driver’s license info was stolen throughout an October knowledge breach at one of many firm’s tech suppliers.

In notices filed this week with a number of U.S. attorneys common, together with California, the ride-hail large stated it was notified on October 9 by the supplier that hackers broke in and stole inner credentials, which have been used to entry Uber’s knowledge.

The corporate stated it subsequently started notifying affected drivers that their private info was saved with the supplier.

TechCrunch has discovered that the supplier is Fireworks AI, which lets builders entry and use open AI fashions. Fireworks reported a knowledge breach final month by which hackers stole its clients’ info, together with billing knowledge and a few personal AI datasets.

On-line productiveness startup Notion confirmed its knowledge was additionally stolen within the Fireworks hack.

“The notices to drivers are in relation to a safety incident impacting considered one of our third-party distributors, Fireworks.ai, which had entry to some Uber knowledge,” an Uber spokesperson informed TechCrunch, deferring our inquiries to Fireworks. 

Uber didn’t say what number of clients are affected by the breach, nor what number of drivers it was notifying in regards to the incident.

When reached by electronic mail, a spokesperson for Fireworks confirmed that the corporate recognized a safety concern involving unauthorized entry to a few of its methods, which affected buyer knowledge, however the spokesperson didn’t deal with our questions in regards to the incident.

Based on knowledge breach notices seen by TechCrunch, the stolen knowledge contains driver’s licenses of two,567 people in Massachusetts, 3,430 folks throughout South Carolina, and 1,873 residents of Rhode Island. A submitting with Illinois confirmed that some state residents had their driver’s license info stolen, however that the variety of affected folks was pending. Uber additionally notified drivers who reside in California, however didn’t say what number of had their info stolen.

The quantity is anticipated to rise as extra knowledge breach notifications roll in.

Fireworks attributed its breach to a financially motivated cybercriminal group whose targets are to promote stolen tokens for accessing giant language fashions, or LLMs. 

No recognized cybercriminal group has taken credit score for the info theft.

That is Uber’s second recognized knowledge breach this 12 months. The corporate reported a safety incident at its Uber Freight truck delivery unit, for which an extortion gang took credit score for stealing knowledge.

Up to date with a response from Fireworks.