Fireworks AI Breach Exposed Notion Customer Chat Transcripts

A breach at Fireworks AI exposed chat transcripts belonging to roughly 1% of Notion's customers, the note-taking company confirmed this week. The stolen data came from Notion AI users of the "Insights" feature. The attackers reached it through Fireworks' cloud provider, not through Notion itself.

Fireworks AI runs an inference platform that lets developers access open AI models. It claims tens of thousands of customers worldwide. Legal tech firm Harvey and AI coding company Cursor are among them.

In its security advisory, Fireworks said the attacker breached its cloud provider and from there gained access to a Fireworks development system. The criminals took customer billing information and some datasets, the company confirmed.

What did Notion lose?

Notion disclosed that the stolen material included chat transcripts of Notion AI customers who used "Insights." The scope is broad by definition. Notion stated the transcripts include "any input to or output from the model that was written to the chat is included in that chat transcript."

There is one mitigating detail. Notion said much of the data was unattributable, and it could not determine from which customer each item was obtained. That claim deserves scrutiny. Unattributable does not mean harmless. It means Notion cannot map the leak to individual accounts.

Notion acted on November 3. It disconnected its systems from Fireworks, deleted the data stored in Fireworks' systems, and cut all connectivity between the two companies.

What was the attackers' motive?

Fireworks said it believes the hackers are financially motivated. Their goal, according to the company, is selling tokens obtained through breached access to large language models.

The scheme has a clear commercial logic. Unauthorized buyers burn through AI model usage without paying for their own compute. The stolen transcripts and billing data may be secondary to that token-resale business.

Note what Fireworks did not say. The advisory does not state how long the attacker had access. It does not quantify the datasets taken. It does not name the cloud provider involved.

Why does a supply-chain breach matter here?

The incident shows how a breach at one infrastructure vendor spills into another vendor's customers. Notion ran its AI features on Fireworks. Fireworks ran on a third-party cloud provider. The attacker entered at the bottom of that stack and reached the top.

This is the second breach affecting Fireworks in as many months, following a security incident in October. Two incidents in two months raises an obvious question about internal security controls. Neither company has disclosed whether the October event and this breach are connected.

For enterprises routing AI workloads through inference providers, the lesson is direct. Vendor due diligence must extend to the vendor's own suppliers. Notion's customers learned of the breach only after Fireworks detected it, alerted Notion, and forensics ran their course.

What happens next?

Notion has severed the connection and deleted its data from Fireworks systems. Fireworks has not said whether it will change cloud providers or disclose the provider's name. Until it does, customers of Harvey, Cursor and its other tens of thousands of users must weigh a vendor with two breaches in two months and an unnamed weak link in its chain.