Fireworks AI confirmed a cyberattack that allowed hackers to access customer billing information and various datasets. The company reported that attackers breached its cloud provider to gain entry to a Fireworks development system. This incident marks the second security breach affecting the platform in two months, following a previous incident in October.
Notion, an online document editor and notetaker, confirmed that the breach affected approximately 1% of its customers. According to a disclosure from Notion, the hackers stole chat transcripts from users of the company's "Insights" feature. The company stated that these transcripts include "any input to or output from the model that was written to the chat is included in that chat transcript," though much of the data was unattributable and could not be linked to specific customers.
Notion reported that it disconnected its systems from Fireworks on November 3, deleted stored data, and terminated all connectivity between the two entities after being alerted to the incident. Fireworks AI, which provides a platform for developers to access open AI models, serves tens of thousands of customers globally, including Cursor and the legal tech company Harvey.
Fireworks AI stated it believes the attackers are financially motivated. The company reported that the hackers' primary goal appears to be selling tokens gained through unauthorized access to large language models. These schemes involve selling access to third parties who can consume AI model usage without using their own resources.
