Uber Data Breach Exposes Thousands of Drivers Through AI Firm - Gizmodo
Thousands of Uber drivers had their personal information compromised after hackers accessed the ride-hailing company's account with third-party provider Fireworks AI.
The ride-hailing company recently filed security breach notices with several state attorneys general detailing the incident. According to a notice dated Nov. 10 filed with California's attorney general, a third-party service provider notified Uber on October 9 that hackers had stolen its internal credentials and used them to access Uber's account with the provider.
On October 13, Uber determined that the hackers had accessed its data, including personal information belonging to drivers. TechCrunch reports that the stolen data included driver's license information. Uber has not disclosed how many drivers were affected nationwide, but state notices provide some idea of the scope of the breach.
Breach Scope
The California notice letters state that approximately 1,873 Rhode Island residents were affected. South Carolina's Department of Consumer Affairs lists another 3,430 affected residents. Meanwhile, TechCrunch reports, citing notices it reviewed, that 2,567 people in Massachusetts also had their information stolen. That brings the total to at least 7,870 people across just three states.
Fireworks AI Breach
Uber confirmed to Gizmodo in an emailed statement that the compromised provider was Fireworks AI, a startup that helps developers access and use open AI models. Fireworks first disclosed its own breach in October but provided an update earlier this week.
The evidence points to a financially motivated cybercriminal group involved in a practice known as 'LLMJacking.' This involves hackers stealing credentials to gain unauthorized access to AI models, then using that access themselves or selling it to others, potentially leaving the victims with enormous bills.
The company said hackers had accessed customer account and billing information, as well as datasets and incomplete AI models belonging to a limited number of accounts. It also disclosed that hackers had gained access to its development machines through a separate security incident involving one of its cloud providers, exposing additional customer data.
The productivity app Notion also confirmed that some of its customers' data was exposed in the Fireworks breach, including AI chat transcripts. Notion said fewer than 1% of its workspaces were affected.
Uber Response
Uber said it immediately cut off its data connections with Fireworks after learning of the breach. In its California notification letter, Uber said it has not identified any misuse of the stolen information so far. However, it is recommending that affected drivers regularly review their account statements and monitor their credit reports for suspicious activity.
Uber is also offering affected drivers free credit monitoring and fraud assistance through Cyberscout. Drivers have 90 days from the date of their notification letter to sign up. Uber also dealt with a security incident in August, when a hacking group claimed to have stolen nearly 1 million files from Uber Freight, the company's logistics subsidiary.
Related
