Fireworks breach exposes Notion user transcripts across less than 1% of workspaces

A security incident at artificial intelligence provider Fireworks AI compromised customer chat transcripts belonging to less than 1% of Notion workspaces, Notion announced. Attackers breached a third-party cloud provider hosting Fireworks research and development machines on October 23, gaining access to development environments the next day to run an unauthorized workload. Notion disconnected from Fireworks and purged its data on November 3, and after Fireworks confirmed the exposure of real customer chats on November 8, Notion started notifying affected users on November 9. [1][2]

The exposed files were transcripts Notion sent to Fireworks for Insights, an administrative feature used to monitor workspace artificial intelligence usage. Notion noted that the vendor had contractually agreed to zero data retention. For most impacted accounts, the transcripts were unattributable, lacking user names, workspace labels, and tool call results, though typed messages were visible. On November 11, Notion revoked API keys uncovered in the compromised chats and advised users to rotate any credentials or passwords submitted to Notion AI. [1][2]

Fireworks attributed the intrusion to an unauthorized workload tied to LLMjacking, in which financially motivated groups sell illicit access to large language models. The vendor brought in Palo Alto Networks Unit 42 to investigate. Notion has disabled Insights and ceased using Fireworks to run open-weight models. [1]