🔍 Read the full analysis: How The Fireworks AI Breach Could Affect Customer Datasets on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI said on November 9 that an incident first disclosed in October had exposed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says chat transcripts from its AI Insights feature may have been in an accessed dataset, affecting fewer than 1% of its workspaces. The number of affected Fireworks customers and what happened to accessed data remain unknown.
Fireworks AI said in a November 9 update that an October security incident reached beyond the internal credentials disclosed earlier, exposing account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The update also describes a later intrusion through a third-party cloud provider; Notion says chat transcripts from its AI Insights feature may have been included in a dataset attackers could access.
Fireworks, which provides infrastructure for companies to run and fine-tune open AI models, said attackers first used internal Fireworks credentials in October to read environment variables from customer evaluation jobs. These variables can contain sensitive configuration information, including API keys or tokens. In its October 9 bulletin, the company said it had not detected unauthorized access to customer models, datasets, training data, inference traffic or personal information. Its November update revised that account, saying it had since found effects on account and billing information and, for some accounts, secrets, datasets and incomplete models.
The company described a second access route involving a third-party cloud provider that hosted Fireworks research and development machines. Fireworks said the provider experienced a security incident on October 23. On October 24, an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact. Fireworks said it detected this activity that day and has not detected further evidence of successful unauthorized access through its customer platform since October 25.
Fireworks listed exposed information as resource metadata, billing and shipping addresses, invoice and payment history, account balances and credit usage. For certain customers, it said, a subset of datasets and incomplete model weights was accessed. The company says it does not store payment card numbers and that those numbers were not affected. It also said it had detected no impact to Inference, Training SDK or Nexus, which it describes as zero-data-retention by default. Fireworks has disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training during its investigation.
The Fireworks AI breach and customer data
Fireworks AI’s November 9 update expanded what it says was exposed in an October incident. The number of affected customers and what happened to accessed data remain unknown.
What may have been exposed
The reported scope includes account records and, for a limited set of accounts, sensitive customer material.
Billing and metadata
Resource metadata, addresses, invoices, payment history, account balances and credit usage were listed.
Secrets and datasets
Fireworks reported access to some secrets, datasets and incomplete model weights; their contents and extent are unclear.
AI Insights transcripts
Notion said transcripts may have been in an accessed dataset. Its estimate applies to its own workspaces.
How the incident unfolded
What customers should know
The investigation is ongoing, and key details have not been disclosed.
Fireworks says it is notifying affected customers about whether their accounts or data were involved.
Ask which datasets, secrets or model files were accessed and what they contained.
Self-service dataset uploads and downloads for specified workflows are suspended during the investigation.
Risks for AI Customer Data
The disclosures matter because AI infrastructure providers may handle information customers use to evaluate, customize or train models. Exposure of a dataset or secrets could create risks beyond the provider itself, depending on what the material contains and whether it can be used to access other systems. Fireworks has not said what the accessed datasets contained or whether the secrets could enable further access, so those risks cannot yet be quantified.
For organizations using the platform, the incident is a reason to establish whether their accounts were affected and what categories of information were involved. The company’s distinction between incomplete model weights and finished models may matter to customers, but Fireworks has not explained what “incomplete” means in this case. The breach also shows why customers need clear information about which services retain data and which do not: Fireworks reported no detected impact to three products, but said other account data and some datasets were affected.
Notion’s account gives one example of how a customer dataset could include information created within another company’s product. Notion said transcripts from its AI Insights feature were in a dataset that attackers may have accessed, and that the share of affected workspaces was fewer than 1%. That figure is Notion’s estimate for its workspaces, not a count of all Fireworks customers or affected datasets.
Products Worth Considering
Dell XPS Tower 8960 Desktop, Intel Core i7-13700, NVIDIA GeForce RTX 4060, 16GB DDR5, 512GB SSD
Dell UltraSharp U2424H 24-Inch FHD Monitor
FLEXISPOT Electric Adjustable Workbench, 48 x 30 in, Maple
As an affiliate, we earn on qualifying purchases.
From October Detection to Update
Fireworks said it identified the initial activity on October 6 and began containment. It started notifying affected customers the next day, then published its first bulletin on October 9 after rotating employee API keys. The company said it revoked additional user API keys and rotated service-account tokens on October 10. That initial bulletin said it had not detected access to customer datasets or personal information.
The later cloud-provider incident occurred on October 23, followed by the unauthorized workload on Fireworks development machines on October 24. Fireworks said it detected that activity the same day. Its November 9 update expanded the reported scope more than a month after the initial detection and described the second route into its environment.
Notion said Fireworks contacted it on November 2 about a small dataset initially identified as synthetic test data. Fireworks later told Notion, on November 6, that malicious actors may have accessed potential customer data, and confirmed the dataset on November 8, according to Notion’s advisory. Fireworks says it notified law enforcement and retained Palo Alto Networks Unit 42 to conduct forensic work.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Use Still Unknown
Fireworks has not disclosed how many customers were affected, named the third-party cloud provider or explained how attackers initially obtained the internal credentials used in the first route. It has not said what the affected datasets contained, how many secrets or model files were accessed, or whether the stolen data was copied, published, sold or used for further attacks.
The company has not defined what it means by “incomplete” model weights, leaving customers without a clear account of how much model information was exposed. Its statements that certain products were not affected and that no further successful access has been detected are based on the investigation to date; Fireworks says the investigation remains ongoing and may reveal more information. The available material does not establish the identity of the attackers. Fireworks said evidence indicated links to a cybercriminal group but did not name one.
Investigation and Customer Notifications
Fireworks says it is continuing its investigation with help from Palo Alto Networks Unit 42 and has notified law enforcement. It has suspended self-service uploads and downloads for specified dataset workflows while it reviews the incident. The company has not provided a date for restoring those functions or said when it expects to publish its next update.
Customers should look for direct notices from Fireworks detailing whether their accounts or data were affected. The next useful disclosures would include the number and types of affected accounts, more information about the datasets and model files involved, and whether investigators found evidence that accessed data was used or shared. Notion’s advisory provides a specific estimate for its own workspaces, but does not resolve the broader scope across Fireworks customers.
Key Questions
What customer information did Fireworks AI say was affected?
Fireworks said the incident affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. It also listed resource metadata, billing and shipping addresses, invoice and payment history, balances and credit usage among the information accessible through an affected internal application.
Were payment card numbers exposed?
Fireworks said it does not store payment card numbers and that they were not affected.
Were Notion AI transcripts involved?
Notion said chat transcripts from its AI Insights feature were in a dataset attackers may have accessed. Notion estimated that fewer than 1% of its workspaces were affected; that is not a figure for all Fireworks customers.
How many Fireworks customers were affected?
Fireworks has not disclosed a total number of affected customers. It described dataset and incomplete-model exposure as affecting a limited set of accounts.
What happens to the investigation now?
Fireworks says its investigation, supported by Palo Alto Networks Unit 42, is ongoing and that it has notified law enforcement. It has temporarily disabled certain dataset upload and download functions, but has not announced when they will resume.
Source: ThorstenMeyerAI.com
