Fireworks AI discloses new breach after cloud provider hack
On October 23 attackers reached development machines and exposed billing data, metadata, and incomplete customer model weights.
Fireworks said a third-party cloud provider hosting its R&D machines was breached on October 23. The next day an unauthorized party used that access to reach development machines and run a workload that exposed customer resource metadata, billing details, and incomplete model weights and datasets. The company said it does not store payment card numbers and detected no further successful access after October 25. It revoked credentials and is working with Unit 42.
Unconfirmed: Fireworks says it has seen no further unauthorized access since October 25; full scope is still under investigation.
- An earlier October incident exposed API keys and tokens linked to LLM token resale.
- Fireworks said it does not store customer payment card numbers.
- Activity was detected October 24, with no further access seen after October 25.
- Unit 42 is helping investigate the incident's full scope.
Impact: Customer metadata, billing data, and incomplete model weights exposed
- Victims
- Fireworks
- Organizations
- Palo Alto Networks Unit 42
From the original article
2 min read at bleepingcomputer.com
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.