Reports: Fireworks reportedly suffered a customer-data breach

• The breach reached billing records and, for some accounts, datasets and incomplete model weights, according to rohanpaul_ai's report.
• Notion AI chat transcripts may have been exposed for fewer than 1% of workspaces, according to a customer notice.
• Some inference vendors have waiting lists and annual spending thresholds in the millions, complicating migration, GergelyOrosz reported.

The ugliest detail is Notion's Insights usage-analytics feature, which put customer chat transcripts in the blast radius. Fireworks links the attacker to token-resale criminals, a business it calls LLMJacking.

Fireworks describes the sequence across its initial bulletin and November 9 update:

• October 6: Fireworks identified unauthorized use of internal credentials. An attacker accessed environment variables used in evaluation jobs for a limited number of customer accounts.
• October 9: Its first bulletin reported no detected unauthorized access to customer models, datasets, training data, personal information or inference traffic within its security perimeter.
• October 23: A third-party cloud provider hosting Fireworks R&D machines experienced a security incident.
• October 24: The attacker used that provider to reach Fireworks development machines, then ran an unauthorized workload that caused additional customer-data impact. Fireworks says it detected the activity that day and began remediation.
• From October 25: Fireworks says it has detected no further successful access by the attacker to the platform customers use.

The company has not named the compromised cloud provider in its update.

Fireworks now identifies these affected data types in its revised disclosure:

• Resource metadata: Resource identifiers, display names, descriptions and creation times.
• Billing information: Billing and shipping addresses, invoice and payment history, account balances and credit usage.
• Secrets: Exposure affecting a limited set of accounts, expanding the earlier disclosure about secrets used in evaluation jobs.
• Model artifacts: A subset of incomplete model weights and datasets for certain customers.

Fireworks says it does not store payment-card numbers, so those were not affected. The update does not give a total number of affected accounts or quantify the datasets and weights accessed.

The company says it has not detected impact to Inference, Training SDK or Nexus, all of which it describes as zero data retention by default. Its investigation remains ongoing.

Notion says the exposed customer transcripts were used for Insights classification jobs, which help customers understand their AI usage. Render was among the affected workspaces, according to the notice shared by anuraggoel.

Notion's public advisory qualifies the broader scope: transcripts were unattributable for the vast majority of impacted workspaces. That designation means they lacked author and workspace labels and did not contain tool-call results; the assurance excludes information present in the chat text itself.

Notion says no other features were affected.

Notion's incident account records separate notifications about testing data and customer transcripts:

1. November 2, evening: Fireworks notified Notion that attackers had accessed a small dataset. Notion determined it contained synthetic testing data, without Notion AI customer data.
2. November 3, morning: Notion disconnected its systems from Fireworks, deleted its data there and stopped communication with the provider.
3. November 6: Fireworks notified Notion of potential customer-data access, prompting another internal investigation.
4. November 8: Fireworks confirmed the newly identified dataset, which Notion determined included customer chat transcripts.

Notion has disabled Insights during the investigation. It also says it is no longer serving open-weight models through Fireworks, a separate use of the provider from the Insights classification jobs.

Some inference vendors have waiting lists and decline customers with annual budgets below the millions, GergelyOrosz reported. He predicted most Fireworks customers would stay if the company provided sufficient transparency about the incident and its security changes.

That prediction describes the wider customer base; Notion's documented disconnection is one concrete departure.

Fireworks says it worked with Palo Alto Networks Unit 42 on four implemented hardening measures:

• Credentials and privileges: Revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, and tightened controls against creation of unauthorized credentials.
• Network isolation: Restricted unauthorized network paths and isolated affected systems to limit movement between systems.
• Stored data: Tightened access to storage and analytics systems and enforced controls against public or unauthorized access.
• Audit integrity: Secured and enhanced logging and monitoring systems.

Fireworks has also disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates.

Training SDK remains available with no training data stored at rest, according to the company. Fireworks Lab-based training operates in an isolated environment with additional network and storage protections.