Overview
- Fireworks detected the initial intrusion on October 6, 2026, and reported that attackers exploited a third-party cloud provider on October 23–24, 2026 to reach development machines and run unauthorized workloads.
- The company says threat actors accessed resource metadata and billing information such as billing and shipping addresses, invoices, account balances, and credit usage for some accounts, while customer payment card numbers were not stored or exposed.
- Investigators found incomplete model weights and datasets for a limited set of customers were accessed, creating risks to intellectual property and raising the likelihood of targeted phishing using real invoice and account details.
- Fireworks revoked and rotated compromised credentials and employee API keys, isolated affected systems, tightened access controls, engaged Palo Alto Networks' Unit 42 for response, and notified law enforcement and impacted customers; the company reports no further customer-platform access detected after October 25.
- Security firms and researchers link this activity to LLMjacking, a financially motivated scheme where attackers steal API keys to run costly unauthorized AI workloads, and the incident highlights how third-party cloud breaches create supply-chain risk for AI infrastructure providers.