(Reuters) – Uber said an unauthorized party used compromised credentials at a service provider to access its data, according to a notice posted on the California attorney general’s website.
The notice, dated November 10, said the provider told Uber on October 9 that the credentials had been compromised and used to access Uber’s account with the provider. Uber severed its data connections with the provider and opened an investigation.
On October 13, the investigation determined the party had used the credentials to access Uber data, and that the recipients’ personal information was among the data accessed, the notice said.
The notice did not name the provider or list the data involved. TechCrunch reported on Friday that the provider was Fireworks AI and that the data included drivers’ license information.
Uber and Fireworks AI did not immediately respond to Reuters requests for comment.
The notice said the incident affected about 1,873 Rhode Island residents. It also carried instructions for residents of the District of Columbia, Maryland, North Carolina, New York and Pennsylvania.
Uber said it is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Recipients have 90 days from the date of the letter to enroll.
The company said it had not identified any misuse of the data to date.
Reporting by Akash Sriram in Bengaluru; Editing by Tasim Zahid
