Fireworks AI discloses wider customer data exposure after second breach
Original title: Fireworks AI gets burned twice as customer data exposure widens
An October 23 cloud-provider compromise reached development systems; billing data and some partial weights were accessed.
Fireworks AI said a third-party cloud provider hosting its research machines was compromised on October 23, and attackers reached development systems the next day to run an unauthorized workload. The company now says billing records and, for some customers, incomplete model weights and datasets were accessed. That widens an October 6 incident in which attackers used internal credentials and read some customer API keys and tokens. Notion told Render that some unattributable Notion AI chats may have been exposed.
Unconfirmed: Fireworks suspects financially motivated LLMJacking, and Notion describes chat exposure as possible rather than confirmed.
- Payment card numbers are not stored and were not affected, Fireworks said.
- CEO Lin Qiao said most weight downloads were partial and stopped.
- Notion said under 1 percent of workspaces may have been affected.
- Exposed chat transcripts lacked separate user or workspace identifiers, Notion said.
- Fireworks worked with Unit 42 and did not state how many customers were affected.
Impact: Billing data, partial weights, datasets, and some API keys exposed
- Vendors
- Fireworks AI
- Products
- Notion AI
- Victims
- Fireworks AIRender
- Organizations
- NotionUnit 42Palo Alto NetworksCursorHarvey
From the original article
2 min read at theregister.comInference biz pins latest breach on cloud provider and LLMJacking miscreants
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.