The disclosure comes shortly after Fireworks AI confirmed that an attacker accessed its development environment via a third-party cloud provider on October 23 and compromised resource metadata, billing information, model weights, and datasets for some customers. Fireworks AI experienced another breach in early October, when hackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts.
Notion learned about the exposed chat transcripts after receiving an alert from Fireworks on November 2 about an exposed dataset that contained only synthetic test data. Notion responded by cutting off traffic to Fireworks, deleting all data from the vendor's systems, and halting training runs by November 3.
Still, Fireworks confirmed on November 8 that customer data had been accessed, including that of Notion users. Notion is a cloud-based workspace used for note-taking, document creation, internal wikis, project management, and task tracking. It includes an AI assistant that can answer questions, summarize content, and help draft text.
