Uber reveals driver’s license data breach via AI vendor Fireworks AI

Uber announced that a cyber‑intrusion led to the theft of thousands of driver’s license numbers that had been outsourced to the artificial‑intelligence cloud provider Fireworks AI. The ride‑hailing company said the breach came to light when an internal audit detected irregular activity in the data warehouse operated by the third‑party service.

Uber stated that the exposed data comprised complete driver’s license numbers, along with names and dates of birth, while financial details like credit‑card numbers or passwords were not included. The firm stressed that payment information or personal addresses were absent from the stolen records, confining the immediate threat to identity‑theft risks.

Fireworks AI, a provider of machine‑learning infrastructure to numerous enterprises, acknowledged that its systems were hit in a “security incident” and that it is working with law‑enforcement and independent forensic investigators. While the company has not revealed how the attackers evaded its defenses, it indicated that the intrusion seems confined to a particular data segment tied to Uber’s driver verification process.

Uber’s response unit has started informing the impacted drivers and is providing free credit‑monitoring for one year. In a statement, the company said it is "taking swift action to reinforce security protocols, conduct a thorough review of third‑party relationships, and prevent future exposures." The episode comes as regulators around the globe heighten scrutiny of tech firms’ protection of personal data, particularly following high‑profile breaches at other transportation platforms.

Industry analysts note that Uber’s dependence on external AI vendors mirrors a wider movement toward outsourcing data‑heavy tasks to specialized cloud services. Although these collaborations can speed up innovation, they also broaden the attack surface, leading to demands for tighter contractual security standards and greater transparency in reporting mechanisms.

The breach is expected to trigger additional investigations by data‑privacy regulators in the United States and Europe. Uber has vowed to cooperate fully and to keep drivers informed as new information surfaces. At the same time, the company’s leadership is under pressure to assure both users and regulators that its data‑protection practices are sufficiently robust to satisfy rising expectations for privacy and security in the gig‑economy sector.