Notion disclosed on November 10, 2026 that it was affected by the Fireworks AI security breach, identifying Fireworks AI as a third-party AI vendor involved in a security incident impacting Notion and its customers2.
Fireworks AI on November 9, 2026 expanded its disclosure of an October security incident, reporting that attackers accessed account and billing information and, for a limited group of customers, secrets, datasets, and incomplete model weights5,6. The AI infrastructure provider had initially described the incident on October 9, 2026 as unauthorized use of internal credentials.
The company identified unauthorized use of internal credentials on October 6, 2026 and began containment, with customer notifications starting October 7, 2026. At that stage, Fireworks AI had not detected unauthorized access to customer models, datasets, training data, personal information, or inference traffic.
A second intrusion through development machines
The breach deepened after a third-party cloud provider hosting Fireworks AI R&D machines experienced a security incident on October 23. On October 24, the unauthorized party used that access to reach Fireworks AI development machines and run an unauthorized workload that led to additional customer data impact. Fireworks AI said it detected this activity the same day and followed incident response processes to take remediation measures and close known critical vulnerabilities.
The affected internal application provided access to resource metadata including identifiers, display names, descriptions, and creation times. Billing information covered billing and shipping addresses, invoice and payment history, account balances, and credit usage. Fireworks AI does not store payment card numbers, which were not affected.
Since the attack, Fireworks AI revoked and replaced credentials and service accounts, restricted unauthorized network pathways, isolated affected systems, and tightened access to data storage and analytics systems3. As of October 25, Fireworks AI had not detected further evidence of successful unauthorized access by the threat actor on the platform customers use.
LLMJacking motive and customer fallout
Fireworks AI said evidence links the breach to a financially motivated cybercriminal threat actor group aimed at selling tokens from unauthorized access to large language models to illicit routing gateways, a technique the company called "LLMJacking". The company said it notified law enforcement and obtained assistance from Palo Alto Networks Unit 42 for forensic analysis. On November 2, Google Threat Intelligence Group and Mandiant published a blog post about the rise of LLMJacking, according to Fireworks AI's bulletin. Researchers at Google Threat Intelligence and Mandiant reported that LLMJacking attacks are driving record costs for compromised organizations, with cloud AI charges reaching as high as $1 million due to fraudulent calls using stolen API keys.
Forbes reported that two customers said they had already substantially moved their business off Fireworks AI's systems, with one describing a series of issues1. Bloomberg characterized the November 9 notification as Fireworks AI's second hack disclosure in weeks4.
Customers whose data was impacted are receiving account-specific details and recommended responses, and the ongoing investigation may produce additional findings, according to Fireworks AI.
ANALYSIS The breach sequence — an initial credential compromise followed weeks later by a lateral move through a third-party cloud provider into development machines — exposed not just metadata and billing records but the core intellectual property customers entrust to an inference platform: datasets and model weights. Notion's public disclosure as an affected downstream customer, combined with the customer departures reported by Forbes, points to immediate commercial consequences for Fireworks AI as it competes for enterprise AI workloads.