Summary
Fireworks, an AI infrastructure company based in San Mateo, disclosed two breaches in October 2026. It says a "limited number of customer accounts" were affected and all were notified. The company has more than 10,000 customers.
Timeline
- October 6: Fireworks discovered the first intrusion, carried out by a financially motivated cybercriminal group. It hired Palo Alto Networks Unit 42 to investigate.
- October 23: Attackers compromised a third-party cloud provider that hosted Fireworks' R&D machines.
- October 24: The intruders used that provider to reach Fireworks development machines and ran an unauthorized workload, exposing more customer data.
- November 2-6: Notion was notified and told by Fireworks that malicious actors may have accessed potential customer data.
- November 10: Fireworks published an updated notice.
Data Stolen
- Account and billing information
- Invoices and payment history
- Secrets (credentials granting access to users or applications)
- Internal Fireworks data
- Datasets and other AI-related data
Notion Impact
Notion said some of its customers were affected. After being notified on November 2, it disconnected from Fireworks, deleted the data held there, disabled its Insights feature (which used Fireworks for classification), and stopped serving open-weight models through Fireworks.
Context: LLMjacking
Google's Threat Intelligence Group and Mandiant describe "LLMjacking," where attackers hijack enterprise access to large language models. Mandiant responded to multiple such incidents in 2026, some with fraudulent cloud charges above $100,000 in a day and cumulative charges reaching $1 million before access was revoked. This disclosure follows the Railway breach, where stolen AI provider keys drove an estimated $740,000 in charges.
Response
Fireworks is working with Unit 42 to strengthen its security posture and is revoking compromised credentials.
Recommended Actions
- If you use Fireworks, rotate any API keys and secrets stored with or shared with the service.
- Review billing and usage for unexpected spend, and set spend caps and alerts.
- Audit which third-party vendors receive your customer data and confirm they can delete it.
- Treat AI provider keys like cloud credentials: scope them narrowly, store them in a secrets manager, and rotate regularly.