Overview
- Fireworks said an attacker who compromised a third-party cloud provider on October 23 accessed its development environment and took resource metadata, billing details, partial model weights and some customer datasets.
- Fireworks also suffered an earlier October intrusion that exposed internal environment variables and API keys, which together widened what attackers could reach.
- Notion was alerted on November 2 and in response cut traffic to Fireworks, deleted Notion data from the vendor, halted training runs by November 3 and has disabled the Insights dataset.
- Notion notified fewer than 1% of workspaces as affected, said most exposed transcripts were unattributable to a specific user or workspace, and told impacted customers to treat the data as exposed and rotate any pasted credentials.
- Fireworks has engaged Palo Alto Networks Unit 42 and law enforcement and investigators are probing ties to LLMjacking-style abuse and the broader intellectual-property, phishing and financial-fraud risks from the stolen artifacts.