A cyberattack at inference provider Fireworks AI exposed some customer data, and Notion has confirmed that the impacted set included Notion AI chat transcripts used for its Insights feature. TechCrunch's Zack Whittaker reported the customer impact on November 12, 2026, after official notices from both companies. Notion says fewer than 1 percent of workspaces were affected.
In a security bulletin last updated November 9, Fireworks said a third-party cloud provider that hosted its research and development machines had a security incident on October 23. On October 24, it said, an unauthorized party used that path to reach Fireworks development machines and run a workload that led to additional customer data impact. Fireworks said it detected the activity the same day and, as of October 25, had not seen further successful unauthorized access on the platform customers use. The company described the bulletin as an update to an earlier notice published October 9, and said it had notified law enforcement and brought in Palo Alto Networks Unit 42.
Fireworks said the affected internal application provided access to resource metadata, billing information such as addresses, invoice and payment history, account balance and credit usage, and, for certain customers, a subset of incomplete model weights and datasets. It said payment card numbers are not stored by Fireworks and were not impacted. The company said the evidence points to a financially motivated cybercriminal group aimed at selling tokens from unauthorized access to large language models, a pattern known as LLMJacking. Fireworks also said it had not detected impact to Inference, the Training SDK and Nexus, which it says are zero data retention by default. VentureBeat later noted that a public post by chief executive Lin Qiao excluded batch inference from that reassurance. The official bulletin does not use that qualifier.
Notion's advisory, originally published November 10 and updated for style the same day, with a further November 11 update, gives a tighter timeline for its own data. On the evening of November 2, Fireworks told Notion that a small dataset had been accessed; Notion said that set was synthetic testing data. By the morning of November 3, Notion said it had disconnected from Fireworks, deleted data in the Fireworks system and stopped communication between the two. On November 6, Fireworks warned that attackers may have reached potential customer data. On November 8 it confirmed a final impacted dataset, and on November 9 Notion contacted affected customers. After reviewing that set, Notion said it included Notion AI chat transcripts used for Insights, and that for the vast majority of impacted workspaces the chats were unattributable: they were not labeled with a user or workspace and did not contain tool-call results.
Notion said it had used Fireworks for classification jobs that powered Insights, and as a general inference provider for open-weight models in its product. It has disabled Insights while it investigates and is no longer serving open-weight models through Fireworks. On November 11, Notion said it revoked exposed Notion API keys found in affected user messages. It has told affected customers they can review the impacted data inside their workspace and should treat it as exposed, rotating any passwords, API keys or other credentials pasted into Notion AI during the incident window. Notion stressed that this was not a breach of Notion's own systems.
Independent write-ups by TechCrunch, BleepingComputer and VentureBeat match the official timelines and the figure of fewer than 1 percent of workspaces. TechCrunch noted that Fireworks has touted customers including Harvey and Cursor; those mentions should not be read as confirmation that those companies' data were in the impacted set. The October access path is earlier than this run's two-day window, but Notion's November 11 update and the November 12 press reports are in-window under the rule that a qualifying source report date, not the underlying event date, governs freshness.