Fireworks says hackers stole billing and AI data in October breaches
Original title: AI company Fireworks says hackers stole data, billing info during October breaches
A second October 23 cloud-host intrusion reached development machines, and Notion cut Fireworks off after possible customer-data access.
Fireworks said a financially motivated group stole account and billing data, secrets, and AI-related data after a breach discovered on October 6. A second incident on October 23 used a compromised third-party cloud host to reach development machines and run an unauthorized workload. Affected customers were notified. Notion disabled Insights and stopped serving open-weight models through Fireworks, while Fireworks hired Unit 42 and is revoking compromised credentials. Fireworks links the cases to LLMJacking described by Google and Mandiant.
Unconfirmed: The criminal group is unnamed, and Fireworks' link to the wider LLMJacking campaign is its characterization.
- Unit 42 is investigating the breach Fireworks discovered on October 6.
- Fireworks says only a limited number of customer accounts were affected.
- The October 23 workload exposed invoices, datasets, and payment history.
- Mandiant cites fraudulent charges above $100,000 a day, up to $1 million.
- Notion was told on November 2 and again on November 6.
Impact: Billing data, secrets, and customer AI datasets stolen
- 1.Rotate secrets and credentials if Fireworks or Notion notified you of exposure.
- ATT&CK
- T1496 Resource Hijacking
From the original article
3 min read at therecord.mediaFireworks said the incident affected a “limited number of customer accounts” — all of whom were notified of the attack.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.