Uber’s Vendor Problem Has a Paper Trail

Uber is notifying drivers that their personal and driver’s license information was stolen in a data breach at a third-party provider, TechCrunch reported, citing notices the company filed with several U.S. attorneys general, including in California.

The company said it was told on October 9 that the provider had been hacked and that stolen internal credentials were then used to access Uber data. Uber’s spokesperson identified the provider as Fireworks AI, which had access to some Uber data and, the spokesperson said, was the source of the incident.

What was actually decided here is narrower than the usual breach melodrama suggests. No court has ruled on liability. No regulator, on this record, has announced an enforcement action. The concrete event is that Uber made state breach filings and began notifying affected drivers. In the United States, and in these jurisdictions, that is how an incident stops being an internal security headache and becomes a public compliance matter.

According to notices seen by TechCrunch, the stolen data included driver’s license information for 2,567 people in Massachusetts, 3,430 in South Carolina, and 1,873 in Rhode Island. An Illinois filing said residents were affected but that the number was still pending. Uber also notified drivers in California without disclosing a public count there.

That state-by-state structure is the part that actually changes incentives. The total does not arrive as one neat national number because disclosure is often made jurisdiction by jurisdiction, through separate notice systems, with separate official audiences. Even when the underlying breach is singular, the public record arrives in pieces, like an institution trying to assemble itself from forms.

Uber did not say how many drivers were affected overall. Fireworks did not respond to TechCrunch’s questions. TechCrunch also reported that Fireworks had disclosed its own breach and attributed it to a financially motivated cybercriminal group seeking to sell stolen tokens for access to large language models.

The business lesson is not subtle. If a vendor holds sensitive data, the vendor’s breach can still become your disclosure exercise, your driver-relations problem, and your name in multiple attorneys general inboxes. TechCrunch noted this is Uber’s second known data breach this year.