Uber数千名司机驾照信息被窃：供应商 Fireworks AI 凭证遭入侵，三州已确认7,870人受影响
网约车公司 Uber 正在通知全美数千名司机，他们的个人信息与驾照信息在今年10月一起针对其技术供应商的入侵中被窃。Uber 本周向加利福尼亚州等多个州的总检察长提交了数据泄露通知，通知落款日期为11月10日。
据通知，供应商在10月9日告知 Uber，其内部凭证已被窃取，并被用来访问 Uber 在该供应商处的数据。Uber 随后切断了与该供应商的数据连接并展开调查，10月13日确认入侵者访问了 Uber 的数据，其中包括如今收到通知的司机个人信息。
这家供应商是超级智能基础设施公司 Fireworks AI。加州总检察长的通知本身没有点名供应商，Uber 发言人向科技媒体 TechCrunch 证实，涉事供应商就是 Fireworks AI。Fireworks 今年10月已披露自身遭到入侵，客户的账户与账单信息以及部分私有数据集被取走；该公司称，作案者是一个以牟利为目的的网络犯罪团伙，手法是窃取凭证去转卖大语言模型的访问权限，其取证工作由 Palo Alto Networks 的 Unit 42 协助进行。在线协作平台 Notion 也证实，其部分客户数据在这起 Fireworks 入侵中被窃。
受影响人数方面，Uber 尚未公布全美总数。目前州级通知可确认的数字是：马萨诸塞州2,567人、南卡罗来纳州3,430人、罗得岛州1,873人，三州合计至少7,870人，实际范围预计还会扩大。
Uber 表示，截至发出通知时尚未发现被窃信息被滥用的情况。公司正向受影响司机提供经 Cyberscout 的免费信用监测与欺诈协助服务，Cyberscout 是 TransUnion 旗下公司。
Thousands of Uber Drivers' License Data Stolen: Vendor Fireworks AI Credentials Breached, 7,870 Confirmed Affected Across Three States
Ride-hailing company Uber is notifying thousands of drivers across the United States that their personal and driver's license information was stolen in an October intrusion targeting one of its technology providers. Uber filed data breach notices this week with attorneys general in several states, including California; the notice is dated November 10.
According to the notice, the provider told Uber on October 9 that its internal credentials had been stolen and used to access Uber's data held with the provider. Uber severed its data connections with the provider and opened an investigation, which determined on October 13 that the intruder had accessed Uber data, including personal information belonging to the drivers now being notified.
The provider is super-intelligence infrastructure company Fireworks AI. The California attorney general notice itself does not name the provider; an Uber spokesperson confirmed to TechCrunch that the vendor involved was Fireworks AI. Fireworks disclosed its own breach in October, in which customer account and billing information and some private datasets were taken; the company attributed the attack to a financially motivated cybercriminal group engaged in stealing credentials to resell access to large language models, with forensic work assisted by Palo Alto Networks' Unit 42. Online productivity company Notion also confirmed that some of its customer data was stolen in the Fireworks breach.
Uber has not disclosed a nationwide total. State notices so far confirm 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, at least 7,870 across three states, with the full scope expected to grow.
Uber said it had not identified any misuse of the stolen information as of its notice. The company is offering affected drivers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company.
来源：加利福尼亚州总检察长办公室数据泄露通知
发布：GSM·美国（发布链接）
图片来源：图：Uber 位于旧金山 Mission Bay 的办公楼（资料图）。HaeB 摄，CC BY-SA 4.0 授权，经 Wikimedia Commons。 / Photo: Uber offices in Mission Bay, San Francisco (file photo). Photo by HaeB, CC BY-SA 4.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
