What happened
Hackers stole internal credentials from Fireworks AI, a third‑party vendor that provides Uber drivers access to open AI models. Using those credentials they accessed Uber’s account with Fireworks and extracted personal data, including driver’s license numbers, for thousands of drivers. Uber learned of the intrusion on October 13 and filed breach notices with state attorneys general. The breach affected at least 7,870 drivers in California, Rhode Island, South Carolina and Massachusetts. Uber has severed its data connection with Fireworks, is working with Palo Alto Networks’ Unit 42 for forensics, and is offering free credit‑monitoring services to affected drivers.
According to breach notices filed with state attorneys general, a third‑party service provider, Fireworks AI, alerted Uber on October 9 that its internal credentials had been stolen. Hackers used those credentials to log into Uber’s account with Fireworks and retrieve driver data.
Uber’s internal investigation confirmed on October 13 that the attackers accessed driver records, including driver’s license numbers. State notices reveal that at least 1,873 drivers in Rhode Island, 3,430 in South Carolina, and 2,567 in Massachusetts were impacted, totaling a minimum of 7,870 individuals across three states.
Fireworks AI, which disclosed its own breach in October, said the attackers also accessed customer billing information, datasets, and incomplete AI models. The breach was linked to a financially motivated group employing “LLMJacking,” a technique that steals credentials to hijack AI model usage for profit.
Uber responded by immediately cutting off data connections with Fireworks, notifying law enforcement, and partnering with Palo Alto Networks’ Unit 42 for forensic analysis. The company has not identified any misuse of the stolen driver data so far but is advising affected drivers to monitor credit reports and account statements.
Uber is offering free credit‑monitoring and fraud‑assistance services through Cyberscout to drivers who sign up within 90 days of receiving the notification.
Why it matters
The incident highlights how supply‑chain vulnerabilities in AI‑focused vendors can expose sensitive personal data of large workforces. Uber’s reliance on Fireworks AI for model access created a single point of failure that attackers exploited, demonstrating the growing risk of “LLMJacking” – the theft of credentials to hijack AI model usage and potentially generate costly unauthorized AI queries. For drivers, the exposure of driver’s license information raises identity‑theft concerns, while for the broader tech ecosystem it underscores the need for stricter vetting of AI service providers and more robust credential‑management practices. Regulators may scrutinize such breaches under emerging AI‑related cybersecurity reporting rules, and companies will likely reassess third‑party AI integrations.
Supply‑chain security: The breach demonstrates how a vulnerability in an AI‑focused vendor can cascade to a major platform, exposing sensitive personal data of a large user base.
Emerging threat vector – LLMJacking: The incident provides a concrete example of credential theft used to hijack AI model access, a practice that can generate massive, unauthorized AI usage bills and expose proprietary model data.
Regulatory implications: State attorneys general are now involved, and the breach may trigger new reporting requirements as states consider AI‑specific cyber‑security legislation.
Driver privacy and financial risk: Exposure of driver’s license numbers and personal identifiers raises the risk of identity theft, prompting Uber to provide credit‑monitoring services as a mitigation step.
Industry response: The event may push other companies to reevaluate third‑party AI vendor risk assessments, adopt zero‑trust architectures, and enforce stricter credential‑rotation and monitoring practices.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?
What to watch next
Watch for further disclosures from Uber about the total number of drivers affected nationwide and any evidence of misuse of the stolen data. Monitor Fireworks AI’s response, including any changes to its security architecture or credential‑rotation policies. Regulators may issue guidance or enforcement actions on AI‑vendor breach reporting, especially as states consider AI‑specific cyber‑security legislation. Finally, watch for industry‑wide discussions on mitigating LLMJacking risks, such as adopting zero‑trust access models for AI services.
Further Uber disclosures on the total number of drivers affected nationwide and any evidence of data misuse.
Fireworks AI’s security remediation steps, including any changes to credential‑management, cloud‑provider relationships, and customer communication practices.
Potential regulatory actions or guidance from state attorneys general concerning AI‑vendor breach reporting and data‑protection obligations.
Industry‑wide adoption of mitigation strategies against LLMJacking, such as ‑based access controls, usage caps, and continuous monitoring of AI model access logs.
Legal actions from affected drivers or class‑action lawsuits alleging negligence in protecting personal data.