Fireworks AI breach exposed Notion AI chats
Attackers reached a Fireworks AI development system through its cloud provider. Notion says about 1% of customers were affected.
A cyberattack on Fireworks AI exposed customer data and showed how a breach at one AI provider can spill into other companies’ products. Fireworks, which gives developers access to open AI models, said attackers first breached its cloud provider and then reached a Fireworks development system. That gave them access to some customer information, including billing data and datasets.
One confirmed affected customer is Notion, the online document editor and note-taking service. According to IT-PUB News, Notion said the incident affected about 1% of its customers and later confirmed that hackers stole chat transcripts from users of its Notion AI “Insights” feature.
Fireworks AI says intruders accessed a development environment
In its latest security advisory, Fireworks AI said the attackers breached its cloud provider and used that access to enter a development environment. The company said that let them reach some customer data stored in or handled by that system.
Fireworks said the stolen material included billing information and some datasets. It also said it believes the attackers were financially motivated and focused on selling access tokens obtained through breaches of large language model systems.
Those tokens can then be sold to unauthorized third parties, who use AI model capacity without paying for it themselves. Fireworks did not say in the source text how much data was taken overall, only that some customers were affected.
Notion severed connections after the alert
Notion said Fireworks alerted it to the incident and later confirmed that hackers had stolen some Notion customer data. On November 3, Notion said it disconnected its systems from Fireworks, deleted the data stored in its systems, and stopped all connectivity between the two companies.
The company later confirmed that the stolen material included chat transcripts from Notion AI customers who had used the “Insights” feature. According to Notion, the transcripts contained “any input to or output from the model that was written to the chat.”
Notion also said much of the data was unattributable, meaning it could not always be tied to a specific customer. That limits what can be determined from the stolen material, but some customer conversations were still exposed.
The breach shows how vendor risk spreads through AI services
The incident stands out because it shows how tightly linked modern AI services have become. Fireworks provides infrastructure that other companies use to build or power their own products, so a breach at one provider can hit customers several steps away from the original attack.
That creates a wider risk for businesses that rely on outside vendors. Even if a company does not directly operate the compromised system, its users’ data can still end up in the fallout when a supplier is breached.
For customers, the concern is straightforward. Billing details and chat transcripts can expose sensitive business information, internal discussions, or other material users may not expect to leave the service they are using. The source does not say exactly what was in the affected transcripts, but it does confirm that model inputs and outputs were included.
Fireworks is dealing with a second incident in two months
The breach is also notable because it is the second security incident involving Fireworks in as many months, after another incident in October. The source does not describe that earlier event in detail, but the timing adds to scrutiny around the company’s security posture.
Fireworks says tens of thousands of customers worldwide use its platform, including legal tech company Harvey and AI company Cursor. That customer base raises the stakes, since a compromise in its systems can potentially affect a wide range of businesses that rely on it.
For now, the confirmed impact in the source is limited to some customer data and Notion’s chat transcripts. Still, the case points to a broader problem for AI companies building on shared infrastructure: one vendor’s breach can quickly reach the services other businesses and their users depend on.
