Data exposure at fireworks AI impacts Notion customers following cloud provider breach

A security incident at Fireworks AI, a platform utilized by developers to access open AI models, has resulted in the exposure of customer data after an attacker breached the company's cloud provider and gained access to a Fireworks development system. The company confirmed that the cybercriminals obtained customer billing information and certain datasets. Among the affected parties is Notion, an online document editor and notetaker, which disclosed that approximately 1% of its own customer base was impacted. Notion confirmed that Fireworks alerted them to the security issue, and subsequently, hackers stole chat transcripts belonging to Notion AI customers who used the Insights feature. Notion stated these transcripts contained any input or output written to the chat, though much of the data was unattributable. In response, Notion disconnected its systems from Fireworks on November 3, deleted the stored data, and severed all connectivity between the two platforms. Fireworks AI noted that the attack appears to be financially motivated, suggesting the hackers aim to sell tokens derived from unauthorized access to large language models (LLMs). This incident marks the second breach for Fireworks in several months, following an event in October. The situation highlights the dependency of technology firms on third-party providers and the potential for cyberattacks to spread across multiple customers.