Uber driver's license breach traced to AI vendor Fireworks

Uber confirmed a data breach that exposed driver's license information for thousands of drivers. The attackers did not break into Uber. They broke into a vendor, and TechCrunch reports that the vendor is Fireworks AI, an inference provider. That is the lesson for a small business: an AI vendor is not only a model endpoint. It is a place where your customers' data can sit, and you must send the notices if it leaks.

What actually happened

TechCrunch published the report on November 13. Uber's filing with the California Attorney General is public. The facts:

• The route. Uber says the vendor told it on October 9 that attackers got in and stole internal credentials. The attackers then used those credentials to get Uber's data. The California filing gives October 7 as the breach date.
• The data. Personal and driver's license information.
• The count. Uber did not give a total. Notices that TechCrunch saw list 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. That is 7,870 in three states. Illinois and California also have affected residents, and TechCrunch expects the total to rise.
• The vendor. Uber's statement refers to a security incident at a third-party vendor. TechCrunch names Fireworks AI. A Fireworks spokesperson confirmed unauthorized access that affected customer data, and did not answer more questions.
• The attackers. Fireworks attributes the breach to a financially motivated group that sells stolen LLM access tokens.

One thing the report does not say: why an inference provider had driver's license data. We do not know. Our guess is the usual one. Documents go to a model for a check or a data extraction step, and a copy stays in a log, a dataset or a batch file.

This is our third post on the Fireworks breaches. We wrote about the Fireworks bulletin on November 9 and the Notion AI transcripts on November 11.

Why the Uber data breach matters for your business

Look at the timeline. The vendor told Uber on October 9. The state notices arrived this week, more than a month later. Uber has a legal team for that work. You probably do not.

The breach was at the vendor, but the notices carry Uber's name. Drivers do not know Fireworks. They know Uber. The same applies to you and your customers.

What to do this week:

1. List the data, not the vendors. For each AI feature, write down what goes into the prompt and the attached files. Find the ID documents, the payment data and the health data.
2. Check what the vendor keeps. Zero data retention often covers inference only. Uploaded files, fine-tuning datasets, batch jobs and logs can have different rules.
3. Redact before the call. If the model needs a license number to do a check, send only that field. Do not send the image if you do not need to.
4. Delete what you uploaded. Old datasets and files at a vendor are risk with no benefit.
5. Read the breach clause. Know how fast the vendor must tell you, and who pays for the notices.

Sources: TechCrunch, California Attorney General breach report.