Fireworks AI, a company that hosts and runs AI models for developers, says a breach that began with stolen internal credentials in October has grown to touch customer data. In an update dated November 9, the company said attackers reached its development machines through a third-party cloud provider, exposing billing details and, for some customers, incomplete model weights and datasets. The details come from The Hacker News and Cyber Security News, which both report on the company’s disclosure. Here is what is known, who should act, and what is still unclear.
How it unfolded
- October 6: Fireworks detected unauthorized use of internal credentials. An outside party accessed environment variables in evaluation jobs for a limited set of accounts, which could capture API keys and tokens stored as secrets.
- October 10: its first bulletin said there was no evidence that customer models, datasets, training data or inference traffic had been accessed (The Hacker News).
- October 23 and 24: the attacker reached Fireworks’ development environment through an unnamed third-party cloud provider hosting its R&D machines, then ran an unauthorized workload on those machines. Cyber Security News says Fireworks detected it on October 24 and closed known critical vulnerabilities.
- October 25: Fireworks reported no further detected access to the platform customers use.
What was exposed
- Resource metadata such as IDs, names, descriptions and creation times.
- Billing information: billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it does not store payment card numbers, so they were not affected.
- For certain customers, a subset of incomplete model weights and datasets.
Cyber Security News adds that Fireworks detected no impact on its Inference, Training SDK or Nexus services, which run with zero data retention by default. The disclosure does not establish that complete production models were taken.
Notion’s side
The Hacker News reports that Notion said the incident affected “fewer than 1% of Notion workspaces.” Notion first thought only synthetic AI testing data was involved, then found Notion AI chat transcripts used for its Insights feature, mostly not attributable to a specific author or workspace. Notion has disabled Insights and, per the report, stopped serving open-weight models through Fireworks.
Who is behind it
Fireworks says the evidence points to a financially motivated criminal group that sells stolen access to large language models through illicit routing gateways, a practice The Hacker News calls “LLMjacking.” The group has not been named.
What Fireworks has done
Both outlets report that Fireworks revoked compromised internal credentials, rotated service account tokens, revoked affected API keys and keys the attacker created, isolated affected systems and tightened access controls. Cyber Security News adds that it notified law enforcement, engaged Palo Alto Networks Unit 42 for forensics and disabled self-service dataset uploads and downloads for Batch Inference and dataset-based training. It is notifying customers whose data was affected directly.
What customers should do
- Replace any revoked Fireworks API keys, and rotate other secrets stored in evaluation environments.
- Rotate third-party credentials with the companies that issued them. Fireworks puts it this way, per Cyber Security News: “Deleting a stored secret does not invalidate the underlying credential.”
- Review access logs, unfamiliar users, API keys, training jobs and datasets for unauthorized activity.
- Notion users: review the impacted data in your workspace, and rotate anything sensitive, such as passwords or API keys, that was pasted into Notion AI during the attack window.
What is still unknown
- The name of the cloud provider and how the attacker got into its environment.
- How many customers are affected and exactly which model weights and datasets were taken.
- How the first internal credentials were obtained.
- The exact dates of the attack window used in Notion’s guidance. The investigation is described as ongoing.
We could not read Fireworks’ own bulletin, so everything here is as reported by the two outlets. Check the company’s security page for the latest.
Sources
- The Hacker News: Fireworks AI confirms wider breach
- Cyber Security News: Hackers breach Fireworks AI through a third-party cloud provider
Image: “Data Security Breach” by Blogtrepreneur, CC BY 2.0, via Wikimedia Commons.
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
