Notion says Fireworks AI breach affected under 1% of its workspaces

Notion's security advisory (updated version of November 12, 2026) says the Fireworks AI incident impacts fewer than 1% of Notion workspaces.

Updated version: November 12, 2026. This post informs you about the recent Fireworks AI Incident and how it’s impacting <1% of Notion workspaces.

Notion says that on analysing the dataset Fireworks gave it on November 8, it found the dataset included Notion AI chat transcripts used for the Insights feature.

Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature

Notion says that for the vast majority of impacted workspaces the transcripts were unattributable: not labeled with who wrote them or which workspace they came from, and without tool call results.

which for the vast majority of impacted workspaces were unattributable. "Unattributable" means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.

Notion's timeline says that on the evening of November 2 Fireworks notified Notion that a small set of data had been accessed by malicious actors, and that on investigation that dataset included Notion AI synthetic testing data and no Notion AI customer data.

On the evening of November 2, Fireworks notified Notion that a small set of data had been accessed by malicious actors. Upon investigation, the dataset included Notion AI synthetic testing data, and no Notion AI customer data was involved.

Notion says that by the morning of November 3 it had disconnected its systems from Fireworks and stopped all communication between its systems and Fireworks, and that on November 4 it deleted all its data in the Fireworks system.

Out of an abundance of caution, by the morning of November 3, Notion disconnected its systems from Fireworks, and stopped all communication between its systems and Fireworks. ... Out of an abundance of caution, on November 4, Notion deleted all its data in the Fireworks system.

Notion says that on November 6 Fireworks notified it that malicious actors may have accessed potential customer data, and that on November 8 Fireworks confirmed the final impacted dataset.

On November 6, Fireworks notified Notion that malicious actors may have accessed potential customer data. ... On November 8, Fireworks confirmed the final impacted dataset.

Notion says it reached out to impacted customers on November 9, and on November 11 revoked exposed Notion API keys found in affected user messages.

On November 9, Notion reached out to impacted customers. ... On November 11, we revoked exposed Notion API keys that were found in affected user messages during our investigation.

Notion recommends that affected customers treat the data as if it were exposed, and rotate any passwords, API keys or other credentials pasted into Notion AI during the incident timeframe.

We also recommend that affected customers treat this data as if it were exposed. If those with affected workspaces have pasted sensitive information, passwords, API keys, or other credentials into Notion AI during the timeframe of the incident, rotate them.

Notion says the Insights feature has been disabled while it investigates and that it is no longer serving open-weight models through Fireworks.

The Insights feature has been disabled as we investigate this incident, and we are no longer serving open-weight models through Fireworks.

Notion says it used Fireworks for classification jobs behind the Insights feature and as a general inference provider to serve open-weight models inside its product.

We used Fireworks for classification jobs to help customers understand their own AI usage through a feature in Notion called Insights, and we used them as a general inference provider to serve open-weight models inside our product.

Fireworks' first bulletin, published October 9, 2026 (last updated October 10), says an unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts.

An unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts.

Fireworks' first bulletin advises affected customers to replace revoked Fireworks API keys and to rotate third-party credentials with the providers that issued them, because removing a stored secret does not invalidate the underlying credential.

Rotate or revoke them with the providers that issued them, then update the applications and Fireworks secrets that use them. Removing a stored secret alone does not invalidate the underlying credential.

Fireworks' update (last updated November 9, 2026) says that at the time of the first bulletin only Fireworks stored secrets, such as those used in evaluation jobs, were known to have been accessed, and that it has since discovered impacts to account and billing information.

At the time of publishing the bulletin, only Fireworks stored secrets (e.g. used in evaluation jobs) were known to have been accessed. Since then, we discovered impacts to account and billing information.

Fireworks' update says that for a limited set of accounts it also discovered impact to secrets, datasets, and incomplete models.

For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.

Fireworks' update says payment card numbers are not stored by Fireworks and were not impacted.

Payment card numbers are not stored by Fireworks and were not impacted.

Fireworks' update does not state how many accounts were affected; it speaks of a limited set of accounts.

For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.

Fireworks says the evidence indicates links to a financially motivated cybercriminal threat actor group aimed at selling tokens from unauthorized access to Large Language Models to illicit routing gateways, known as LLMJacking.

The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as "LLMJacking".

Fireworks says a third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23, and that on October 24 the unauthorized third party used it to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact.

A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23. On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact.

Fireworks says it notified law enforcement and obtained assistance from Palo Alto Networks Unit 42 to conduct forensic analysis.

we notified law enforcement and obtained assistance from a leading cybersecurity firm, Palo Alto Networks Unit 42, to help conduct forensic analysis.

Fireworks says the affected internal application provided access to resource metadata, billing information, and, for certain customers, a subset of incomplete model weights and datasets.

The affected internal application provided access to the following categories of information: Resource metadata ... Billing information ... Model weights and datasets, for certain customers, a subset of incomplete model weights and datasets were accessed.

Fireworks says it has not detected any impact to Inference, Training SDK and Nexus, which it says are all zero data retention (ZDR) by default.

We have not detected any impact to Inference, Training SDK and Nexus, which are all zero data retention (ZDR) by default. These findings are based on our investigation to date.

Fireworks says it disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates.

we’ve disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while we investigate this incident.

Neither Fireworks' bulletins nor Notion's advisory, as opened on November 13, say that an AI model was used in the attack or name one.

The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs)