Wire reporting: (Reuters, via CNA)

Uber is notifying thousands of U.S. drivers that personal information, including driver's licenses, was accessed after a security incident at third-party AI vendor Fireworks AI, according to state data-breach filings and reporting Friday^1,2.

TechCrunch reported that notices filed with several U.S. attorneys general, including California, said Uber was told on Oct. 9 that a provider's internal credentials had been stolen and used to access Uber data¹. CNA, carrying Reuters, said a California attorney general notice dated Nov. 10 described the same Oct. 9 notice, said Uber cut data connections with the provider, and said that on Oct. 13 Uber determined personal information had been accessed².

TechCrunch identified the provider as Fireworks AI, which hosts open AI models¹. An Uber spokesperson told TechCrunch the driver notices relate to a security incident at Fireworks.ai that had access to some Uber data, and referred further questions to Fireworks¹. A Fireworks spokesperson told TechCrunch the company identified unauthorized access to some systems that affected customer data, but did not address questions about the Uber incident¹. CNA said Uber and Fireworks did not immediately respond to Reuters².

Notices seen by TechCrunch said stolen data included driver's licenses of 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island¹. An Illinois filing said some residents' license information was taken but did not give a number; Uber also notified California drivers without stating a count¹. CNA said the California notice listed about 1,873 Rhode Island residents and included instructions for residents of the District of Columbia, Maryland, North Carolina, New York and Pennsylvania².

CNA said Uber is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, with 90 days from the letter date to enroll, and that it had not identified any misuse of the data to date². TechCrunch said Fireworks attributed its own breach last month to a financially motivated group seeking to sell stolen tokens for accessing large language models, and that no known group has claimed the theft¹. Notion previously confirmed customer data was also taken in the Fireworks incident, according to TechCrunch¹.

Uber did not publish a nationwide total of affected drivers¹. How many additional states will file notices, and whether the stolen credentials were used beyond accessing stored driver records, was not stated in the filings described Friday^1,2.