The Fireworks AI breach reached data behind Notion AI

What Fireworks confirmed

Fireworks says [1] its first October incident involved access to secrets stored for uses such as evaluation jobs. Its November update added a second event: a third-party cloud provider that hosted Fireworks research and development machines was compromised on October 23, and an intruder reached Fireworks development machines on October 24.

The affected internal application provided access to resource metadata and billing information. Fireworks also found that secrets, datasets and incomplete model weights were affected for a limited set of accounts. It says payment card numbers were not stored and were not affected.[1]

Fireworks attributes the activity to financially motivated criminals seeking model access for illicit routing services. The company says it revoked and replaced credentials, reduced privileges, isolated systems, tightened data controls and improved logging with help from Palo Alto Networks Unit 42.[1] Independent reporting from The Register and The Record corroborates the expanded scope and two-incident timeline.[3][4]

Why the Notion disclosure changes the impact

Notion confirmed [2] that the data included chat transcripts used by its AI Insights feature. The company says fewer than 1% of workspaces were affected and that it contacted identified customers.

For most affected workspaces, the transcripts had no separate author or workspace label and contained no tool-call results. That reduces some linkage, but the words inside a transcript can still identify a person, company, project or credential. Notion therefore tells affected customers to treat the reviewed data as exposed.[2]

Notion disconnected from Fireworks on November 3, deleted its data in Fireworks, disabled Insights, stopped serving open-weight models through Fireworks and halted training runs. Its help guidance also says Fireworks had given a contractual zero-data-retention commitment for the relevant use, but Notion learned during the investigation that data had been retained.[5]

Zero data retention did not cover every path people assumed

Fireworks says it has not detected an impact to its Inference, Training SDK or Nexus products, which it describes as zero data retention by default.[1] Notion says it sent stored requests and responses to Fireworks for a separate Insights classification workflow, so the transcript exposure involved a different data path.[5]

An AI product can use one provider through several paths: live inference, evaluations, batch classification, fine-tuning, analytics and development tooling. A retention promise needs to name the exact endpoint and workflow. Teams should not extend one product's data terms to every adjacent service.

The same separation applies to credentials. Rotating a Fireworks API key does not invalidate a cloud key or database token that an evaluation job exposed. Each issuing system must revoke its own credential, and responders need logs from that system to check use.

Response steps for affected Notion and Fireworks users

• If Notion contacted your workspace, use the desktop Security incident review to download and preserve the affected-content records before starting remediation.[5]
• Ask each affected member to inspect the exact transcript text for passwords, API keys, access tokens, customer data, regulated information and internal project names.
• Revoke every exposed secret at the system that issued it, create a replacement and update dependent applications. Removing text from a workspace does not invalidate a credential.
• Review authentication, cloud, source-control, database and model-provider logs for use of exposed credentials during and after the incident window.
• For a notified Fireworks account, review API keys, users, evaluators, training jobs, datasets and unfamiliar resources against the account-specific notice.
• Map any accessed dataset or model artifact to contractual, regulatory and customer-notification obligations, then record who owns each follow-up.
• Keep phishing warnings specific: attackers may know account names, balances or project metadata even when they do not have a password.

A vendor-control test for every AI team

List every model and infrastructure vendor, then record the product, endpoint, data category, retention rule, subprocessor, credential type and environment for each connection. Include evaluation and analytics jobs because those paths can hold richer data than live inference.

Run a traceable test record through each path and verify where it appears, how long it remains and who can retrieve it. Contract language matters, but a technical retention test can reveal a configuration or product boundary that procurement documents missed.

Keep production secrets out of prompts, examples and evaluation fixtures. Use scoped test credentials where a workflow genuinely needs a secret, and alert on use outside the expected account, region or service.

What remains uncertain

Fireworks has not named the third-party cloud provider or published the number of affected Fireworks accounts. It describes the affected set as limited and says its investigation may reveal more information.[1]

The public notices do not fully explain which Fireworks system retained the Notion transcripts, the complete transcript time range or how the retained data connected to the affected internal application. Notion gives affected customers account-specific review data instead of publishing those details broadly.[2]

Fireworks says it has not detected impact to three named zero-retention products. That is a current investigative finding, rather than proof that no other evidence will emerge. Teams should watch both companies' bulletins for revisions.

Frequently asked questions

• Was Notion itself breached? Notion says the incident occurred at Fireworks AI, a third-party vendor, and that no other Notion features were affected.
• How many Notion workspaces were affected? Notion says fewer than 1%, but it has not published a numeric count.
• Were the transcripts anonymous? Most lacked separate user and workspace labels, but the transcript text could still contain identifying or sensitive information.
• Do unaffected Notion customers need to rotate credentials? Notion says no action is needed if neither the user nor workspace owner received a notice.[5] Teams can still improve their policy against putting secrets in AI chats.
• Did Fireworks lose payment card numbers? Fireworks says it does not store payment card numbers and they were not affected.
• Is the investigation finished? No. Both companies describe ongoing monitoring or investigation, and Fireworks says later findings could change the disclosed scope.