Uber has disclosed a data breach that exposed sensitive information belonging to its drivers, including license plate numbers, according to a notice filed with the California attorney general's office. The ride-hailing giant said an unauthorized third party accessed its systems through a service provider, compromising personal user data.
The notice, dated November 10, states that Uber was alerted to the incident by the service provider in early October, just days before the company says it became aware of the breach. An investigation revealed that the intruder used compromised internal credentials to gain access to the data. Uber immediately severed ties with the vendor to prevent further unauthorized access.
While Uber has not disclosed the number of affected individuals, it confirmed that driver license plate numbers were among the stolen data. The company stated it has not identified any misuse of the information as of the notice date. In response, Uber is offering free credit monitoring and fraud assistance to those impacted.
The breach has been traced to Fireworks.ai, an artificial intelligence infrastructure startup that counts Uber among its clients. Fireworks.ai, which serves over 10,000 companies globally, reported its own data breach last month. The company said hackers stole customer billing information and some AI datasets. Notion, a workspace app and another Fireworks.ai client, also confirmed that its data was compromised in that incident.
This is not the first security issue for Uber. In August, the company launched an investigation after a hacking group claimed responsibility for a breach at Uber Freight, its logistics division. That incident raised concerns about the company's cybersecurity posture across its various business units.
The disclosure comes amid growing scrutiny of data security practices in the tech and ride-hailing industries. Regulators and consumer advocates have increasingly called for stronger protections for personal information, especially as companies rely on third-party vendors for critical services.
Uber's handling of this breach will be closely watched, as the company has faced previous criticism for its response to security incidents. The company's decision to cut ties with Fireworks.ai and offer monitoring services is a step in the right direction, but questions remain about the scope of the breach and the long-term implications for affected drivers.
As the investigation continues, Uber has not provided a timeline for when affected individuals will be notified or when full details of the breach will be made public. The company has directed inquiries to Fireworks.ai for further comment.
