The report
Fireworks AI’s original October incident notice centered on credentials exposed through evaluation environments. Its November 9 revision explicitly expands the known categories to account and billing information, as well as datasets and incomplete model weights belonging to a limited group of customers. The newer account supersedes the earlier statement that no customer model or dataset access had been detected.
Fireworks says unauthorized use of internal credentials was identified on October 6. Following key rotations and notifications, a separate October 23 incident at a third-party cloud provider led to unauthorized access on October 24 to Fireworks R&D machines and additional customer data. It says no subsequent successful access to customer platform systems was detected after October 25. These are two stages of the same vendor’s investigation; their chronology does not prove a single identical exploit route.
The revised scope includes metadata, billing and shipping addresses, invoice and payment history, account balances, limited datasets and incomplete models. Fireworks says it has not detected impact to its zero-data-retention inference, Training SDK and Nexus services. It is still investigating; those negative findings should not be rewritten as proof that every customer workload was untouched. See the Fireworks dossier, the November scope update and the original October credential-rotation coverage.
A downstream customer identifies its data
In a separate November 10 notice, Notion confirmed that Fireworks-held data included transcripts from its AI Insights feature, affecting fewer than 1% of Notion workspaces. Most transcripts lacked account or author attribution and did not contain tool-call results, although the text itself may still contain sensitive details. Notion disconnected Fireworks on November 3, says it contacted affected customers on November 9, disabled Insights and stopped serving open-weight models through Fireworks. Its incident notice does not establish that Notion’s own systems were breached.
This correction changes what an affected customer should check. Revocation must reach the issuers of exposed third-party API keys. Customers notified about AI Insights need to review the actual transcript content rather than infer safety from missing workspace labels. Dataset and billing access require separate assessment from secret theft. Treat the evolving disclosed scope as evidence of the investigation’s progress, not as a count of confirmed downstream account takeovers.