Cyberattack on Fireworks AI allowed hackers to access Notion customers’ chat transcripts

Fireworks AI confirmed that an attacker breached its cloud provider to reach a Fireworks development system, gaining access to some customer data. In its latest security advisory, the company said the cybercriminals took customers' billing information and some datasets. Fireworks, a platform developers use to access and run open AI models, says tens of thousands of customers worldwide use it, including legal tech firm Harvey and AI company Cursor.

At least one confirmed affected customer is Notion. The document editor and notetaker disclosed that the incident affected around 1% of its own customers. Notion said Fireworks alerted it to a security incident and later confirmed that hackers had stolen some Notion customer data. On November 3, Notion said it disconnected its systems from Fireworks, deleted the data stored in its systems, and stopped all connectivity between the two.

Notion confirmed this week that the hackers took chat transcripts from Notion AI customers who used the "Insights" feature. The company said the transcripts include any input to or output from the model written to the chat, but added that much of the data was unattributable and could not be tied to a specific customer.

Fireworks said it believes the attackers are financially motivated, focused on selling access tokens gained by breaching large language models. These schemes involve selling usage to unauthorized third parties, who can burn through AI model usage without paying for their own resources. This is the second breach affecting Fireworks in as many months, following a security incident in October.

The incident illustrates how a breach at one infrastructure provider can cascade into unrelated customer products through shared dependencies. For builders, the open questions are how Fireworks' cloud provider was compromised, whether the October and November events are connected, and how many other platform customers beyond Notion had data exposed. It remains unclear whether the token-resale motive points to ongoing access or whether the affected systems have been fully contained.