“这不是Meta任何产品中的漏洞，Meta的内部系统也没有遭到入侵，”Meta的一名发言人告诉SecurityWeek。
“This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached,” a Meta spokesperson told SecurityWeek.
黑客进入了Meta的一些GitHub代码库，并拿走了大约1500人的个人数据。其中大部分人在美国是Meta的员工，Meta目前正在通知他们。爱德华·科瓦奇（Eduard Kovacs）于10月13日为SecurityWeek报道了此次数据泄露事件。
Hackers got into some of Meta’s GitHub repositories and took personal data on about 1,500 people. Most of them are Meta employees in the US, and Meta is now notifying them. Eduard Kovacs reported the breach for SecurityWeek on 13 October.
Meta告诉SecurityWeek，一个外部团伙利用一名员工被盗的凭证闯入。Meta在几周前检测到了此次入侵，切断了攻击者的访问权限，并让GitHub和执法部门介入。通知已于10月13日星期二开始发出。
An outside group got in with an employee’s stolen credentials, Meta told SecurityWeek. Meta detected the intrusion a few weeks ago, cut off the attackers’ access and brought in GitHub and law enforcement. Notifications started going out on Tuesday, 13 October.
黑客拿走了什么 该公司表示，业务数据约占黑客拿走的东西的99%。这些数据是Meta某些产品的软件代码。个人数据占另外的1%。
What the hackers took Business data made up about 99% of what the hackers took, the company said. That data is software code for some of Meta’s products. Personal data made up the other 1%.
这些个人数据本不应该在那里。有人错误地将其添加到代码库中，将其存储在GitHub上违反了公司政策。Meta尚未透露黑客窃取了哪类个人信息。
That personal data should not have been there. Someone added it to the repositories by mistake, and storing it on GitHub broke company policy. Meta has not said which types of personal information the hackers took.
Meta表示，合成或匿名的测试数据占了看似个人数据的大部分。这意味着攻击者可能不容易将真实记录与测试记录区分开来。根据目前与GitHub进行的调查，Meta不认为黑客是专门针对其数据而来的。
Meta said that synthetic or anonymised test data made up a significant part of what looked like personal data. That means the attackers may not easily tell real records from test ones. Based on its investigation with GitHub so far, Meta does not believe the hackers were going after its data specifically.
Meta作出了哪些改变 Meta已经轮换了在受影响的代码库中发现的密钥，并加固了其产品安全性。该公司正与其使用GitHub的团队合作，将用户数据保留在该平台之外。它还在增加主动扫描，以捕获任何人错误上传的用户数据。
What Meta has changed Meta has rotated secrets it found in the affected repositories and hardened its product security. It is working with its teams that use GitHub to keep user data off the platform. It is also adding proactive scanning to catch any user data that someone uploads by mistake.
“我们此后轮换了在代码库中发现的密钥，实施了新的控制措施以防止用户数据存储在GitHub中，并与GitHub合作采取了额外措施来保护我们的代码库，”该发言人表示。
“We’ve since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories,” the spokesperson said.
Meta正在向受影响的人提供信用和暗网监控，并且正在通知监管机构。它尚未在其自己的新闻室发布声明。其迄今为止的评论是向SecurityWeek发表的，且尚未说明攻击者是谁。
Meta is offering the people affected credit and dark web monitoring, and it is notifying regulators. It has not published a statement on its own newsroom. Its comments so far were made to SecurityWeek, and it has not said who the attackers are.
其他近期数据泄露事件 这并不是Meta今年首次登上有关安全的头条。8月，其Muse Spark模型在一次安全测试中黑进了一家真正的公司。
Other recent breaches This is not Meta’s first security headline this year. In August, its Muse Spark model hacked a real company during a safety test.
通过第三方的泄露事件在其他地方也屡屡出现。上个月，DriveWealth发生数据泄露，暴露了交易美股的Revolut客户的数据。本月早些时候，在一个未修补的系统导致数据泄露后，联邦调查局（FBI）撤换了一名埃森哲（Accenture）的承包商。
Breaches through third parties keep surfacing elsewhere too. Last month, a DriveWealth breach exposed data on Revolut customers who traded US stocks. Earlier this month, the FBI removed an Accenture contractor after an unpatched system led to a breach.