Fireworks AI discloses wider October breach as Notion confirms chat impact

This is a new development in a story we reported earlier: Fireworks AI discloses second breach tied to compromised cloud provider.

Fireworks AI disclosed on November 9, 2026 in an updated security bulletin that its October incidents exposed additional customer data beyond the initial report, widening the breach first disclosed in early October 2026.

Fireworks said that intruders obtained account and billing information, including billing and shipping addresses, payment and invoice history, account balances, and credit usage. A limited group of accounts lost more: intruders took stored secrets, datasets, and incomplete model weights from them, and those weights are pieces of an AI model’s learned parameters. The company does not store payment card numbers, and none were taken. Metadata for exposed resources included identifiers, display names, descriptions, and creation times.

Notion separately confirmed that some Notion AI chat transcripts were affected, saying the breach reached fewer than 1% of its workspaces. The company said it discovered that the newly accessed dataset held Notion AI chat transcripts used for the Insights feature. ‘we discovered that it included Notion AI chat transcripts used for the Insights feature,’ Notion said. The company first said only Notion AI synthetic testing data, with no customer data, was exposed, but it later found that potential customer data had been involved.

Fireworks said it first detected the incident at 9 AM PDT on October 6, 2026, when an outside party used stolen internal Fireworks credentials to read customer account environment variables holding API keys and tokens stored as secrets. The company made its first public disclosure of the incident in early October 2026, but sources disagree on the date of the initial bulletin: BreachNews and Get Insanely Good at AI date it to October 9, 2026, while The Hacker News dates it to October 10, 2026.

Fireworks said intruders breached its research and development machines, hosted by a third-party cloud provider, on October 23, 2026. The company said the attacker used that foothold on October 24, 2026 to execute an unauthorized workload on Fireworks development machines. Fireworks also said it detected the activity on October 24 as it was happening, and that no successful unauthorized access reached the customer platform after October 25, 2026.

Fireworks said evidence ties the activity to a financially motivated group behind LLMjacking, in which actors sell access to large language model tokens through illicit routing gateways. But it linked a cybercriminal group to the early October incident and gave no information on responsibility for the second incident. The company cited research on LLMjacking from Google Threat Intelligence Group and Mandiant published on November 2, 2026. Google said attackers increasingly go after AI infrastructure to carry out LLMjacking, and Google Threat Intelligence Group and Mandiant reported that fraudulent calls made with stolen API keys drove cloud AI charges as high as $1 million per victim.

Fireworks notified law enforcement and brought in Palo Alto Networks Unit 42 for forensics. It swapped out compromised credentials and service accounts, isolated affected systems, and limited access to stored data. It also closed off unauthorized network pathways, took away elevated permissions, expanded logging and monitoring, and disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training.

Fireworks said its Inference, Training SDK, and Nexus services use zero data retention by default, meaning customer data is not stored by default, and have not shown impact. Fireworks Lab training keeps running in an isolated setting. The company said it is alerting customers whose data was impacted, and a spokesperson said it is working with Notion and Cursor on managing the incident. ‘We take this matter very seriously and are connecting directly with customers to provide appropriate support,’ Fireworks said.

Notion shut down its Insights feature and halted serving open-weight models through Fireworks, and said the incident affected no other platform features. The exposed chats were unattributable, meaning they carried no labels identifying an author or workspace, and they contained no tool call results in most affected workspaces.

More than 10,000 customers use Fireworks, among them Harvey, Notion, and Cursor. The company offers a high-performance inference platform for deploying and running open-source AI models such as Mistral, Meta’s Llama, and Google’s Gemma. It has not named the cloud provider involved or said how many customer accounts were affected, and it said its investigation may reveal additional information.

Get Insanely Good at AI said that two customers took substantial business elsewhere because of security and communication issues, citing Forbes summaries it could not access directly. Insurance Journal said, citing a person familiar with the matter, that tens of thousands of files with customer data were involved in some cases. Get Insanely Good at AI said 16 days passed between detecting the second intrusion and disclosing it publicly, and that the two intrusions were 18 days apart.

Notion told affected customers to treat the transcripts as exposed and to change passwords, API keys, or any credentials pasted into Notion AI. It also said customers should review affected data securely inside their own workspaces. Fireworks said it is notifying customers whose data was affected.