Uber driver's licenses stolen in Fireworks AI breach

The breach traces back to Fireworks AI's cloud provider, which attackers allegedly breached to reach its development system. From there they used internal credentials to access client data — a path that bypassed Fireworks AI's own defenses by starting one layer down the stack. Fireworks AI says the intruders were motivated by a desire to steal and sell LLM tokens, a detail that points to a commercial market for AI compute access rather than a targeted grab for personal records.

The Uber exposure is a downstream effect. Uber requires all drivers to upload proof of a valid driver's license, insurance, residency, and bank statements, so the data held by vendors handling driver records is unusually sensitive. Uber has not said how many drivers in total are affected, but it has committed to notifying all affected workers. The company operates a fleet of more than 10 million drivers and couriers, according to third-party estimates, and in June announced additional background checks and expanded policies for reviewing and banning drivers based on public records.

The incident also surfaces in Notion's breach notices, which state that anonymized chat transcripts of Notion AI customers were obtained. That broadens the picture beyond ride-hailing: the same intrusion reached multiple AI-adjacent clients, and the initial notices involving Notion suggest the fallout may extend to other Fireworks AI customers not yet publicly identified.