Notion Data Breach: Fireworks AI Hack Exposed AI Chats

Was Notion hacked?

Not directly: Notion says the incident was "not a breach of our systems" but a breach at Fireworks AI, a third-party AI vendor, which exposed Notion AI chat transcripts for fewer than 1% of workspaces ^[1].

Notion used Fireworks for two things: classification jobs behind Insights, a feature that helps customers understand their own AI usage, and as a general inference provider to run open-weight AI models inside Notion ^[1]. BleepingComputer explains that Insights gives workspace administrators visibility into how their teams use AI ^[4].

Notion says no other features were affected ^[1]. It has disabled Insights while it investigates and no longer serves open-weight models through Fireworks ^[1]. TechCrunch reports that, according to Notion, Fireworks later confirmed that some Notion customer data was stolen ^[3].

What data was exposed in the Notion breach?

The stolen dataset included Notion AI chat transcripts used for Insights, which, TechCrunch reports Notion as saying, contain "any input to or output from the model that was written to the chat" ^[3]. For most affected workspaces, Notion says the transcripts were unattributable ^[1].

Notion defines "unattributable" as chats that were not labelled with who wrote them or which workspace they came from, and that did not contain tool call results ^[1]. "Beyond what's in the chat transcript itself, there's no information tying the chat back to workspaces, users, or companies," it says ^[1][5].

The catch is the content itself. Anything a person typed into Notion AI, such as a password, an API key or confidential text, could be in a transcript ^[1]. Notion says it found such keys in affected messages: on 11 November it revoked exposed Notion API keys, and on 12 November it reported exposed third-party API keys to the vendors that issued them ^[1].

At Fireworks itself, the wider breach touched resource metadata, billing information (addresses, invoices, balances and credit usage) and, for some customers, incomplete model weights and datasets ^[2]. Fireworks says it does not store payment card numbers, and they were not affected ^[2].

When did the Notion breach happen?

The attacker reached Fireworks in late October 2026; Notion learned customer data was involved in early November and contacted affected customers on 9 November ^[1][2].

• 23 October: a third-party cloud provider hosting Fireworks R&D machines had a security incident ^[2].
• 24 October: the attacker used it to reach Fireworks development machines and ran an unauthorised workload; Fireworks says it detected this the same day ^[2].
• 2 November: Fireworks told Notion a small dataset had been accessed; Notion initially found only synthetic testing data ^[1].
• 3-4 November: by the morning of 3 November Notion had disconnected its systems from Fireworks, and on 4 November it deleted all its data in the Fireworks system ^[1].
• 6 November: Fireworks said customer data may have been accessed ^[1].
• 8 November: Fireworks confirmed the final impacted dataset; Notion later found it included Notion AI chat transcripts used for Insights ^[1].
• 9 November: Notion reached out to impacted customers ^[1].
• 11-13 November: Notion's advisory, dated 12 November, carries update notes: on 11 November it revoked exposed Notion API keys, and on 12 November it reported exposed third-party API keys to the vendors that issued them ^[1].

Some reports compress this timeline; Notion's own advisory is the most detailed dated account ^[1].

What should Notion users do now?

Notion says that if you have not heard from it, your workspace has not been identified as affected and no action is needed right now ^[1]. For affected customers, it recommends ^[1][4]:

1. Review the exposed data. Affected customers can retrieve it securely inside their workspace using emailed instructions ^[1]. BleepingComputer reports that workspace owners can use Security incident review in Notion's desktop web interface and share a download link with members ^[4].
2. Treat the data as exposed, even though most transcripts are unattributable ^[1].
3. Rotate credentials. If you pasted sensitive information, passwords, API keys or other credentials into Notion AI during the incident period, change them ^[1][5].
4. Include keys for other services. Notion says it has reported exposed third-party API keys it found to the vendors that issued them; its advice to customers is to rotate any API keys pasted into Notion AI ^[1].
5. For general breach checks, Was My Data Leaked? How to Check and What to Do After a Data Breach covers what to look at after any breach (general advice, not part of Notion's notice).

A general precaution, not part of Notion's advice: keep live secrets out of AI chats. Password Managers Explained: How They Work and Whether They Are Safe explains safer ways to store and share credentials, and Is ChatGPT Safe for Your Privacy? What AI Chatbots Do With the Data You Share looks at what AI chat tools do with your data.

What is Fireworks AI and how was it hacked?

Fireworks AI is a platform developers use to access and run open AI models; Notion describes it as one of the most used global AI infrastructure platforms, powering tens of thousands of customers ^[1][3].

Fireworks says a cloud provider that hosted its R&D machines suffered an incident on 23 October, which an unauthorised party used the next day to reach Fireworks development machines ^[2]. SecurityWeek gives 24 October as the date customer data was compromised ^[5]. Fireworks says that as of 25 October it had not detected further evidence of successful unauthorised access on the platform its customers use ^[2].

TechCrunch calls this the second breach affecting Fireworks in as many months ^[3]. An earlier incident, announced in a 9 October bulletin, involved stored secrets; BleepingComputer reports hackers accessed environment variables containing API keys and tokens for a limited number of accounts ^[2][4].

Fireworks says it notified law enforcement and is working with Palo Alto Networks Unit 42 on forensics ^[2]. Its response included revoking and replacing credentials, isolating affected systems and temporarily disabling self-serve dataset uploads and downloads for batch inference and dataset-based training ^[2].

What is LLMjacking?

LLMjacking is the theft of access to large language models so that it can be resold; Fireworks says the evidence indicates links to a financially motivated cybercriminal group engaged in it ^[2].

According to Fireworks, the group is aimed at "selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways" ^[2]. TechCrunch, which does not use the term, reports that Fireworks believes the attackers are financially motivated and that buyers are unauthorised third parties who use the stolen access without paying for their own compute ^[3]. SecurityWeek, for its part, ties the second Fireworks incident to a recent rise in LLMjacking activity ^[5].

Notion itself describes only "malicious actors" and says nothing about who they were or what they wanted ^[1]. What it does report is that exposed API keys were found in affected messages, and it revoked the Notion keys and reported the third-party keys to their issuers ^[1]. Fireworks notes that Google Threat Intelligence Group and Mandiant published research on LLMjacking on 2 November ^[2].

Is it safe to keep using Notion AI?

Notion says the vendor connection has been cut, the data deleted from Fireworks and the affected feature disabled, but its investigation is ongoing ^[1].

• Reassuring: no other Notion features were affected; most transcripts cannot be tied to a user; affected customers have been contacted ^[1].
• Reassuring: Fireworks says its inference service, Training SDK and Nexus are zero data retention by default and showed no impact ^[2].
• Open question: BleepingComputer reports that Notion's FAQ says Fireworks had contractually committed to zero data retention for Notion data ^[4]; none of the sources reviewed explains how the Insights dataset came to be accessible.
• Concerning: Notion gives a share (fewer than 1% of workspaces) but, according to SecurityWeek, did not disclose how many customers were affected ^[5].

Notion says it will "raise the standard" for how customer data is protected ^[1]. TechCrunch argues the incident shows how tech companies rely on other providers for their own offerings ^[3].

What happens next?

Both companies say their investigations are ongoing; Notion says it will update its advisory and Fireworks says it will provide further updates as appropriate ^[1][2]. Fireworks warns its investigation "may reveal additional information" ^[2].

Points to watch: whether Fireworks names other affected customers, whether Notion revises the "fewer than 1%" figure, and whether Insights, currently disabled, returns ^[1][2]. Until then, Notion's advisory page is the place to check for official updates ^[1].

The wider lesson for businesses is about vendor chains. TechCrunch notes the breach shows how tech companies rely on other providers for their own products, so an attack on one can spill over to its customers ^[3]. Fireworks says it has since tightened access to data storage and analytics systems, restricted network pathways and enhanced logging and monitoring with Unit 42 ^[2]. As a general precaution (not from either company), teams that send data to AI vendors can ask what is stored, for how long and how quickly they would be told about an incident.