Fireworks AI: Notion Client Chats Stolen

Key Takeaways

1Hackers stole chat transcriptions of Notion customers via Fireworks AI

2About 1% of Notion customers are affected, with often untraceable data

3Fireworks AI mentions a breach through its cloud provider and financial motivations

4This is the second incident in two months at Fireworks AI

Why it matters : The incident highlights how a vulnerability at a service provider can expose the data of customers from other companies and lead to cascading effects.

A breach at Fireworks AI allowed hackers to access chat transcriptions from users of Notion's AI. The publisher mentions that about 1% of customers are affected and clarifies that much of the data cannot be linked to a specific user. Fireworks AI cites financial motivations and acknowledges a second incident within two months.

At Notion, Stolen Chat Transcriptions and 1% of Customers Affected

Notion has confirmed that hackers stole chat transcriptions from customers using Notion's AI through the Insights feature. The company estimates that approximately 1% of its customers were affected by this breach. The transcriptions include all inputs and outputs from the model recorded in the chat. Notion specifies that a large portion of this data does not allow for the identification of which customer it belongs to.

Entry Point at the Cloud Provider and Data Stolen at Fireworks AI

Fireworks AI reports that a malicious individual infiltrated its cloud service provider and gained access to a development environment, thereby enabling the consultation of data belonging to certain customers. According to the company, billing data as well as several datasets from customers were stolen. Fireworks AI, a platform used by developers to access open AI models and boasting tens of thousands of customers worldwide, has confirmed the exposure of data for some of them.

Le brief IA que lisent les pros

Le brief IA que les pros lisent chaque soir

Les 7 actus IA du jour, décryptées en 5 min. Gratuit.

Inclus dès l'inscription : notre sélection des meilleurs guides & comparatifs IA.

Choisissez votre rythme

Gratuit · Pas de spam · Désabonnement en 1 clic

What Notion Did After the Alert from Fireworks AI

Notion stated that it was alerted by Fireworks AI about a security incident and confirmed the theft of certain customer data. On November 3, Notion disconnected its systems from Fireworks AI, deleted the data stored in its systems related to this provider, and terminated all connectivity between the two companies.

Motivations Attributed to the Attackers and Repeated Incidents

Fireworks AI believes that the attackers were motivated by financial reasons, aiming to sell tokens obtained through access to large language models. According to the company, these operations involve selling unauthorized third parties the ability to use AI models without utilizing their own resources. This is the second incident affecting Fireworks AI in two months, following a previous one that occurred in October. This situation illustrates the dependence of tech companies on their suppliers and the potential for the effects of a cyberattack to spread.