Uber Drivers’ Licenses and Notion AI Chats Both Leaked Through One Hacked AI Vendor, Fireworks, Showing How a Single Supplier Breach Spreads

A single breach at an AI infrastructure company is now showing up in the customer notices of some very familiar brands. Uber has begun telling drivers that their personal and driver’s license information was stolen after hackers broke into one of its tech providers, and TechCrunch reported on November 13 that the provider is Fireworks AI, a platform developers use to run and fine-tune open AI models. One day earlier, Notion confirmed that the same incident exposed chat transcripts from some Notion AI users.

Neither Uber nor Notion was hacked directly. Both were exposed because they had sent data to an AI vendor that was. For any business wiring large language models into its products and back office, that is the part of this story worth studying.

What Uber Is Telling Drivers

According to breach notices Uber filed this week with several U.S. state attorneys general, including California, the company was told on October 9 by the provider that attackers had broken in and stolen internal credentials, which were then used to reach Uber data. An Uber spokesperson told TechCrunch the notices relate to “a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.”

The state filings reviewed by TechCrunch show driver’s license data stolen for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. That is 7,870 people across those three states alone. An Illinois filing listed the number of affected residents as pending, and Uber also notified California drivers without giving a count, so the total is expected to climb as more notices are filed. Uber did not say how many people were affected overall. TechCrunch noted it is the company’s second known breach this year, after an earlier incident at its Uber Freight unit.

Notion’s AI Chat Transcripts Were Caught Up Too

In its security advisory, Notion said the incident affects fewer than 1% of its workspaces. Notion used Fireworks for classification jobs behind an AI usage feature called Insights and as a general inference provider for open-weight models. Fireworks first alerted Notion on November 2. Notion cut its systems off from Fireworks by the next morning and deleted its data there on November 4. On November 6, Fireworks told Notion that customer data may have been accessed, and on November 8 it confirmed the final affected dataset, which included Notion AI chat transcripts used for Insights.

Notion said most of those transcripts could not be tied to a specific user or workspace, but it still told affected customers to treat the data as exposed and to rotate any passwords, API keys or other credentials they had pasted into Notion AI during the incident window. The company said it revoked exposed Notion API keys found in affected messages on November 11, and on November 12 reported exposed third-party API keys to the vendors that issued them. It has disabled Insights and stopped serving open-weight models through Fireworks.

How the Fireworks Breach Unfolded

Fireworks first disclosed an incident on October 9. In an updated bulletin dated November 9, it said that when it first published, only Fireworks-stored secrets were known to have been accessed, but investigators later found impact to account and billing information and, for a limited set of accounts, to secrets, datasets and incomplete models.

The update also described a second intrusion path. A third-party cloud provider that hosted Fireworks research and development machines suffered its own security incident on October 23. The next day, the attacker used that access to reach Fireworks development machines and run an unauthorized workload that touched more customer data. Fireworks said it detected the activity the same day and has seen no further evidence of successful access to its customer platform since October 25. It listed the exposed data as resource metadata, billing details such as addresses, invoices and account balances, and for some customers a subset of incomplete model weights and datasets. It said it does not store payment card numbers and found no impact to its inference, Training SDK and Nexus products, which it says are zero data retention by default.

Fireworks is working with Palo Alto Networks Unit 42 on forensics and hardening, including revoking and replacing credentials and service accounts, isolating affected systems and tightening access to data stores. The Record reports the San Mateo company has more than 10,000 customers, and The Register notes Fireworks has not said how many were affected. According to TechCrunch, Fireworks blamed a financially motivated group that sells stolen access tokens for large language models, and no known gang has claimed the theft.

Why It Matters for Business

Your AI vendor is now part of your attack surface. Most companies run vendor security reviews on payroll, CRM and cloud providers. Far fewer apply the same scrutiny to the inference platforms and model hosts their engineering teams adopt quickly to ship AI features. This case shows that data sent for fine-tuning, classification or evaluation can sit in a supplier’s development environment long after the job is done.

The chain runs deeper than one vendor. Fireworks itself was reached partly through its own cloud provider. That is a fourth-party risk: a supplier of your supplier. Contracts and questionnaires rarely look that far down, yet that is where this attacker found a way in.

Prompts are data, and often secret data. Notion’s advice to rotate credentials pasted into AI chats is a reminder that employees and customers routinely drop API keys, passwords and confidential details into AI tools. Once those prompts are stored for analytics or training, they become a target. Attackers hunting for LLM access tokens have every reason to sweep them up.

Disclosure timelines stretch. Fireworks’ first notice came on October 9, yet the full scope reached downstream customers only in November, and individual drivers are hearing about it in mid-November. Companies need incident clauses that require prompt, updated notice as an investigation widens, not a single early alert.

What to Do Now

• Inventory every AI provider that receives company or customer data, including tools adopted by individual teams.
• Send only the minimum data needed, strip personal identifiers before fine-tuning or evaluation, and prefer zero data retention settings where offered.
• Set retention and deletion terms in contracts, and confirm data is purged after a project ends.
• Ask vendors how their own cloud and hosting providers are secured and monitored.
• Scan AI chat logs and prompts for secrets, and rotate any keys that may have been shared.

The Bottom Line

The Fireworks incident is turning into a case study in how quickly one AI supplier breach can travel, from a cloud host to an inference platform to the customers of household-name companies. As businesses push more of their data through AI services, vendor security reviews have to keep pace with the speed of adoption.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous