Fireworks AI breach also exposes billing data and model weights
Original title: Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights
Later access on October 23 through a third-party cloud host reached R&D machines; card numbers were not stored.
Fireworks AI said a follow-up investigation found access beyond an incident detected on October 6. Attackers used internal credentials, reached development machines on October 23 via an unnamed cloud host, and on October 24 ran a workload that touched more customer data. Exposed material includes billing records, metadata, secrets, datasets, and incomplete model weights for a limited set of accounts. Payment cards were not stored, and Fireworks reports no further successful access since October 25.
Unconfirmed: Ties to a group selling stolen LLM access are Fireworks' assessment; the cloud provider is unnamed.
- Initial detection was October 6, 2026, at 9 a.m. PDT.
- Early review found API keys and tokens in evaluation-job environment variables.
- Fireworks rotated affected API keys and keys the attacker created.
- Billing data includes addresses, invoices, balances, and credit usage.
- Fireworks links the activity to financially motivated LLMjacking.
Impact: billing data, secrets, datasets, and incomplete model weights exposed
- 1.Check Fireworks notices if your account was flagged as impacted.
- Victims
- Fireworks AI
From the original article
2 min read at thehackernews.com
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.