🔍 Read the full analysis: A Guide To Checking AI Data Exposure After The Fireworks Breach on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI’s November 9 update says attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says transcripts from its AI Insights feature may have been in an accessed dataset, affecting fewer than 1% of workspaces. The number of affected Fireworks customers and the fate of accessed data remain unknown.
Fireworks’ revised account follows an initial bulletin on October 9. The company said it had first identified suspicious activity on October 6, when someone used internal Fireworks credentials to read environment variables from some customers’ evaluation jobs. Environment variables can contain credentials such as API keys and tokens. Fireworks said it began notifying affected customers on October 7 and rotated employee API keys and service-account tokens over the following days.
The company later identified a second route into its systems. It said a third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23. The next day, an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload that caused additional customer data impact. Fireworks said it detected this activity that day and reported no further evidence of successful access by the actor on its customer platform after October 25.
In its update, Fireworks listed exposed information as resource metadata, billing details and, for certain customers, a subset of datasets and incomplete model weights. Billing details may include addresses, invoice and payment history, account balance and credit usage. Fireworks said it does not store payment card numbers and that those numbers were not affected. It also said it had detected no impact to its Inference, Training SDK or Nexus products, which it describes as zero-data-retention by default.
Notion said Fireworks first contacted it on November 2 about a dataset it believed was synthetic test data, then warned on November 6 that customer data might have been accessed. Notion said the relevant dataset was confirmed on November 8 and may have included Notion AI Insights chat transcripts. The company put the share of affected workspaces at fewer than 1%; it did not state a total number in the supplied advisory material.
Fireworks said it notified law enforcement and engaged Palo Alto Networks’ Unit 42 for forensic work. As a precaution during its investigation, it disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training.
Checking AI data exposure after the Fireworks breach
Fireworks AI’s November 9 update describes a wider breach than first reported. Customers should check notices and review potentially exposed data and credentials.
What may have been exposed
The expanded account includes several types of customer information and AI assets.
Account and billing details
Billing details may include addresses, invoices, payment history, balances and credit usage.
Secrets and AI assets
Some accounts may have had secrets, datasets and incomplete model weights accessed.
AI Insights transcripts
Transcripts may have been in an accessed dataset. Notion says fewer than 1% of workspaces were affected.
How the disclosure changed
The November update broadened the known impact beyond the first bulletin.
- Described misuse of internal credentials.
- Reported no detected access to customer models, datasets or training data.
- Added account and billing information.
- Added possible exposure of secrets, datasets and incomplete models for a limited set of accounts.
What customers can check
Use direct provider notices to determine whether your organization or resources are in scope.
Check Fireworks communications for affected accounts, resources and response steps. Notion customers can assess whether they used AI Insights.
Review relevant environments for exposed secrets and rotate credentials where appropriate. Look for unfamiliar account or billing changes.
Fireworks says its investigation is ongoing; certain self-service dataset uploads and downloads were temporarily disabled as a precaution.
What Customers Should Check
The incident matters because Fireworks provides infrastructure companies use to run and fine-tune AI models. Data sent to an AI service provider can include business information, credentials, training material or model assets that customers may regard as proprietary. The expanded disclosure means customers should not assume the incident was limited to environment variables, as the first bulletin suggested.
Organizations using Fireworks should review the provider’s notices and determine whether their account, billing records, datasets, secrets or model-development work could fall within the affected scope. They can check for exposed credentials in the relevant environments and rotate them where appropriate, while reviewing account activity and billing records for unfamiliar changes. These are precautionary steps, not confirmation that any particular customer’s credentials were taken or misused.
Notion customers should look for direct communications from Notion and assess whether their organization used AI Insights during the relevant period. Notion’s figure of fewer than 1% refers to its workspaces, not to all Fireworks customers or to the share of transcripts exposed. The two companies have not provided a public count that would establish the incident’s overall scale.
Products Worth Considering
Fitbit Sense 2 Health and Fitness Smartwatch, Shadow Grey/Graphite
Withings Body Smart Wi-Fi and Bluetooth Body Composition Scale
Garmin Forerunner 165 GPS Running Smartwatch, 43 mm, Whitestone
As an affiliate, we earn on qualifying purchases.
From October Detection to Update
Fireworks’ October 9 bulletin described misuse of internal credentials and said it had not detected unauthorized access to customer models, datasets, training data, inference traffic or personal information. The November 9 notice added impacts to account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. That change reflects a broader account of what the investigation had found, rather than a single unchanged description of the incident.
Fireworks dates its first detection to October 6 and its second intrusion to October 24. Notion’s account places its notification sequence in early November, before Fireworks published the expanded update. The materials supplied do not identify the cloud provider involved or name a threat group. Fireworks said its evidence indicated links to a cybercriminal group, but the source text cuts off before providing the group’s name or further detail, so no attribution can be established here.
““For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.””
— Fireworks AI, November 9 security update
Scope and Data Fate Remain Unknown
Fireworks has not disclosed how many customers were affected, which cloud provider was involved, or how the internal credentials used in the first activity were obtained. It has not said what happened to data that attackers accessed, whether the information was copied or later misused, or whether additional customers will be identified.
The company also has not explained what “incomplete” model weights means in this case, or how much of each affected dataset or model was accessible. Notion’s disclosure does not specify how many workspaces were affected, which transcripts were involved, or what those transcripts contained. Fireworks says its investigation is ongoing and may produce further information; the available statements do not establish that every possible impact has been found.
Watch for Customer Notices
Fireworks says its investigation is continuing with support from Unit 42 and that it has notified law enforcement. Customers should watch for direct notices from Fireworks and review any follow-up that identifies affected resources or provides specific response steps. The company’s temporary suspension of certain self-service dataset uploads and downloads remains a stated precaution while it investigates.
Further updates may clarify the number of affected accounts, the scope of the cloud-provider incident, and whether accessed data was used or disclosed beyond the intrusion. Notion customers can also monitor the company’s security communications for additional detail about the AI Insights dataset and any account-specific impact. Neither company has supplied a timeline for a final investigation report.
Key Questions
What did Fireworks AI say attackers accessed?
Fireworks said account and billing information were affected. For a limited set of accounts, it also found impact to secrets, datasets and incomplete models, along with resource metadata. It said payment card numbers were not stored by the company and were not affected.
Were Notion AI chat transcripts involved?
Notion said chat transcripts from its AI Insights feature may have been in a dataset attackers could have accessed. It said fewer than 1% of workspaces were affected. The public information provided does not identify the number of workspaces or the specific transcripts involved.
What should Fireworks customers do now?
Review notices from Fireworks, check which services and datasets your organization used, and examine relevant account and billing activity. Consider rotating credentials that may have been present in affected environments. These precautions do not mean that a particular customer’s data or credentials were confirmed exposed.
Did Fireworks say its AI products were all affected?
No. Fireworks said it had detected no impact to Inference, Training SDK and Nexus, which it describes as zero-data-retention by default. It also said it disabled some self-service dataset functions while its investigation continues.
What details are still missing?
Fireworks has not named the cloud provider, given a total number of affected customers, explained how the first credentials were obtained, or said what happened to accessed data. It has not detailed what made the affected model weights incomplete. The investigation remains ongoing.
Source: ThorstenMeyerAI.com
