Fireworks AI breach exposed Notion customer chat transcripts

By Daniel Okafor

Notion said a Fireworks AI breach affected around 1% of its customers and that hackers stole chat transcripts from users of its Notion AI “Insights” feature.

Fireworks AI operates a platform that developers use to access and use open AI models, and it said an attacker breached its cloud provider before reaching a development system. That system granted access to some customer data.

What did Fireworks say the attackers took?

Fireworks said in its latest security advisory that cybercriminals took customers’ billing information and some datasets from a development system reached through its compromised cloud provider. The company also said the development system contained some customer data.

Notion, an online document editor and notetaker, confirmed that it was among the affected customers. It said the breach affected around 1% of its customers. This week, Notion specified a specific category of loss: chat transcripts belonging to Notion AI customers who used Insights.

The 1% figure covers the breach’s reported impact on Notion’s customer base; Notion did not label it as the percentage of Insights users. Fireworks and Notion did not provide a transcript count or a separate percentage for feature users. Nor did the companies say every affected Notion customer used Insights.

How did the breach reach Notion?

Notion said Fireworks alerted the company to a security incident and later confirmed that hackers had stolen some customer data belonging to Notion customers. On November 3, Notion said it took three steps:

• Disconnected its systems from Fireworks.
• Deleted the data stored in its systems.
• Stopped all connectivity between the two.

Those steps ended the live link between the companies, but they came after the theft. Notion’s disclosure shows that incident response can stop an active connection without reversing data already removed.

What did the stolen chat transcripts contain?

Notion said the stolen transcripts include both sides of a written model exchange. It defined the scope this way: “any input to or output from the model that was written to the chat is included in that chat transcript.”

The wording means a user prompt and the model’s response were included when written to the chat. Notion also said much of the exposed data was unattributable. It could not determine which customer each item came from. The limit constrains how precisely Notion can map the incident to individual users, according to the company.

Why did the attackers target Fireworks?

Fireworks said it believes the hackers were financially motivated, with their goals focused on selling tokens after gaining access to large language models, or LLMs.

Fireworks said these schemes rely on selling access to unauthorized third parties. Those parties can burn through AI model usage without using their own resources. Unlike the billing information and datasets, the model access was the commodity Fireworks said the hackers intended to sell.

What is the scale of Fireworks AI’s customer base?

Fireworks touts tens of thousands of customers worldwide, including legal technology company Harvey and AI company Cursor. Notion is at least one confirmed affected customer.

Fireworks and Notion’s disclosures show how a compromise at one technology provider can spill into another company’s customer base when their systems remain connected to shared services. The connectivity Notion disclosed explains how the attack moved beyond Fireworks.

Fireworks and Notion’s disclosures also show how one company’s product can depend on another provider’s infrastructure. Fireworks supplied the model-access platform, while Notion connected its own systems to Fireworks.

Can Fireworks prevent another breach?

Fireworks described this as the second breach affecting the company in as many months, following a security incident in October. Two disclosed security problems in two months turn the next intrusion test into a broader control question.

The immediate test is whether Fireworks can close the cloud-provider and development-system access path before another breach exposes more billing information, datasets and chat transcripts.