Notion says Fireworks AI breach exposed customer chat transcripts

Notion has told customers that a breach at Fireworks AI, its AI infrastructure provider, exposed Notion AI chat transcripts tied to the Insights feature. BleepingComputer reported that the affected transcripts came from a dataset Fireworks AI gave Notion on November 8, and that fewer than 1% of Notion users are impacted.

Fireworks first told Notion on November 2 that an attacker had accessed a small dataset, which Notion initially judged to contain only synthetic test data. By November 3, Notion disconnected from Fireworks, deleted all data from the provider's systems, and stopped training runs. GBHackers reported that Fireworks warned on November 6 that customer information may also have been reached; Fireworks confirmed the affected dataset on November 8, and Notion notified impacted customers on November 9. Notion revised its update on November 10 for clarity, without changing the facts it had already reported.

Notion then discovered the dataset included Notion AI chat transcripts used for Insights. BleepingComputer reported that Notion said: "Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable." Notion said "unattributable" meant the chats lacked labels for the author or originating workspace, and the transcripts did not include tool call results. GBHackers noted that information written inside a conversation could still identify users, companies or sensitive activities, and that Notion's statement does not say every affected transcript was unattributable. Notion said its own systems were not breached.

Notion has disabled Insights and no longer serves open-weight models through Fireworks. The company said no other Notion features were affected. Affected workspace owners can review exposed information through Security incident review in Notion's desktop web interface and share a link so members can download their own transcripts. Notion advises rotating any passwords, API keys, or other credentials that users entered into affected chats. Customers who have not received a notice are not currently identified as affected, so no action is needed for now.

Fireworks AI's wider breach

The Fireworks compromise exposed more than Notion data. The Hacker News reported that Fireworks AI's investigation found attackers reached its development environment through an unnamed third-party cloud provider hosting research and development machines on October 23. On October 24, the attacker used that access to reach development machines and run an unauthorized workload that caused further customer data exposure. Fireworks said as of October 25 it had not detected further successful unauthorized access on the platform customers use. Fireworks said the breach exposed resource metadata, billing details such as addresses and invoice history, and a portion of incomplete model weights and datasets for some customers. Payment card numbers were not stored and were not affected, and Fireworks is alerting customers whose data was impacted. The company has implemented credential revocation and rotation, isolated affected systems, tightened access controls, and improved logging and monitoring. Fireworks said evidence points to a financially motivated cybercriminal group that sells tokens from unauthorized LLM access to illicit routing gateways; the company assessed the activity as LLMjacking.

The same report said Fireworks' earlier notice, published October 10, stated that unauthorized use of internal credentials allowed a third party to access environment variables in evaluation jobs for a limited number of customer accounts. Fireworks detected that activity on October 6 at 9 a.m. PDT and initially found no signs that attackers accessed customer models, datasets, training data, inference traffic, or personal information.

Five Nines reported on November 10 that Railway exposed secrets and triggered about $740,000 in AI charges, and on November 7 that WorkOS said an AI hacking agent escaped its sandbox and accessed sales data. Defenders should treat any credentials pasted into Notion AI chats as exposed, rotate Fireworks API keys if notified, review billing and usage for unexpected LLM charges, and confirm third-party AI vendors' data retention commitments.