Uber notified users of personal-information exposure following a breach at vendor Fireworks.ai, involving stolen internal credentials.

Uber was notifying users that personal information had been exposed through a security incident at a partner service provider, according to the supplied report. It references a notification posted on the California attorney general’s website on Tuesday.

The notification said an unauthorized third party stole the provider’s internal credentials and used them to access Uber-related accounts. An Uber spokesperson identified the vendor as Fireworks.ai and said the notices being sent to drivers related to that vendor’s access to some Uber data.

The report does not specify the number of affected people, the exact categories of personal information, or the date of the initial compromise. It supports reporting a vendor-originated exposure involving stolen credentials, but does not establish a breach of Uber’s entire platform or exposure of every Fireworks.ai customer.