Cyberattack on Fireworks AI allowed hackers to access Notion customers’ chat transcripts

A recent cyberattack at Fireworks AI has compromised some data of its customers, the company has disclosed. The breach occurred when hackers gained access to Fireworks' development system via its cloud provider. The attackers obtained billing information and certain datasets from Fireworks' customers, which include legal tech company Harvey and AI company Cursor.

Notion, an online document editor and notetaker, is among the confirmed affected customers. Notion reported that the breach impacted roughly 1% of its customers. Fireworks promptly alerted Notion to the security incident and confirmed that the hackers had stolen certain Notion customer data. Notion disconnected its systems from Fireworks, deleted the data stored in its systems, and ceased all connectivity between the two platforms.

The hackers targeted Notion's "Insights" feature, which includes chat transcripts for Notion AI customers. These transcripts contain all inputs and outputs from the model, but Notion noted that much of the data is unidentifiable and cannot be traced back to individual customers. This incident highlights the interconnected nature of tech companies and how cyberattacks can have far-reaching consequences.

Fireworks believes the hackers are financially motivated, aiming to sell stolen access tokens to unauthorized third parties for exploitation of large language models (LLMs). This marks the second breach for Fireworks within a span of two months, following another security incident in October.