Notion Customer Data Compromised in Fireworks AI Hack
Collaborative workspace platform Notion is notifying a small set of customers that their information was compromised in a data breach involving Fireworks AI, which was targeted twice in October.
A cloud platform for running and fine-tuning open source AI models, Fireworks AI was hacked twice in October: once through compromised internal credentials, and once through a third-party cloud provider that was hosting Fireworks R&D machines.
The second incident, linked to a recent rise in LLMJacking activity, occurred on October 24, when attackers executed an unauthorized workload leading to the compromise of customer data.
Data accessed
Fireworks contained the incident the same day and notified Notion on November 2 that Notion AI data had been accessed. Prior to the incident, Notion used Fireworks as a general inference provider for delivering open-weight models.
Notion's investigation determined that hackers accessed Notion AI chat transcripts used for the Insights feature, which helps customers understand their AI usage.
Beyond what's in the chat transcript itself, there's no information tying the chat back to workspaces, users or companies.
Customer response
Fewer than 1% of Notion workspaces were affected, and most of the transcripts were unattributable to a customer or workspace. The company has contacted affected customers with instructions on how to securely retrieve and review their data.
We recommend treating this data as exposed. If you pasted sensitive information, passwords, API keys, or other credentials into Notion AI during the incident, rotate any exposed credentials.
Related
