After an attack via a third-party cloud provider, Fireworks AI has lost more customer data. As a result, AI chat transcripts from Notion also leaked.
Fireworks AI, a provider of AI infrastructure, confirms that hackers gained access to its development machines on 24 October via a third-party cloud provider. It is already the second breach at the company in a short time. At the beginning of October, attackers already obtained secrets such as API keys and tokens from a limited number of accounts.
Notion, the platform for notes and project management, announced on 11 November that the breach also affects its users. Notion uses Fireworks to run some of the open-weight models behind Notion AI.
What data was stolen
According to Fireworks, the attackers accessed resource metadata, such as identification numbers, names, descriptions and creation timestamps. Billing data was also present in the affected internal application: billing and shipping addresses, payment history, account balance and credit usage. Fireworks does not store payment card numbers, so these were not leaked.
For a limited group of customers, secrets, datasets and incomplete model weights were also viewed. Fireworks sees no impact on Inference, Training SDK and Nexus, because by default they retain no data (zero data retention). The company stresses that the investigation is still ongoing.
According to Fireworks, the evidence points to a financially motivated cybercriminal group that wants to resell access to language models to illegal routing gateways. This practice is called LLMJacking. Google Threat Intelligence Group and Mandiant published a blog post on 2 November about its rise.
Notion switches off Fireworks
On 2 November, Notion received a notification from Fireworks about an exposed dataset that supposedly contained only synthetic test data. The company then cut off traffic to Fireworks, deleted all data held by the vendor and stopped the training runs on 3 November. On 8 November, Fireworks confirmed that customer data had been accessed after all, including that of Notion users.
The data concerns Notion AI chat transcripts used for Insights, a feature that gives workspace administrators insight into how teams use AI. Notion switched off that dataset. According to Notion, for most affected workspaces the transcripts could not be attributed: they contain no name of the author or workspace, nor any results of tool calls. Fireworks had contractually committed to zero data retention for Notion data.
According to Notion, fewer than 1 percent of its users are affected. Owners of potentially affected workspaces can view the data via Security incident review in the desktop web interface and share a link that lets members download their own transcripts. Anyone who received no notification, either directly or via the workspace owner, does not need to do anything for now.
Measures and what comes next
Fireworks is working with Unit 42 of Palo Alto Networks on the forensic investigation and informed the police. The company replaced credentials and service accounts, removed unnecessary elevated privileges and isolated affected systems. Logging and monitoring were also strengthened.
Self-service uploads and downloads of datasets for Batch Inference and dataset-based training are temporarily switched off. Training SDK remains available without storage of training data, and training via Fireworks Lab runs in an isolated environment. Since 25 October, Fireworks has seen no new successful access to the platform that customers use.
Notion advises affected users to replace passwords, API keys and other credentials if they entered them in a chat with Notion AI. Fireworks is notifying affected customers directly and promises further updates on the investigation.