International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 68 · Tier A7 sources49 comments in the community

AI company Fireworks says hackers stole data, billing info during October breaches

The Record ·

AI company Fireworks says hackers stole data, billing info during October breaches

The Brief · written from 7 sources

  • Fireworks AI says attackers breached its development machines after compromising a third-party cloud provider that hosted its research and development work.
  • Hackers accessed account and billing information, secrets, datasets and incomplete model weights for a limited set of customer accounts, all of which were notified.
  • This is the second known Fireworks hack in a matter of weeks; the original incident was first reported in early October.

Why it matters

If you use Fireworks AI, data you sent or stored there, including datasets, secrets and billing details, may have been accessed, so you should check whether your account was affected and rotate any credentials kept on the platform.

Who’s affected

  • Fireworks AI customers
  • Notion and its customers

What to do

  1. Check whether your account was among those notified by Fireworks AI.
  2. Rotate any API keys or secrets stored with Fireworks AI.

Fireworks said the incident affected a “limited number of customer accounts” — all of whom were notified of the attack.

Read the full story at therecord.media ↗

What developers are saying

Based on 49 comments · Mostly critical

Commenters are largely critical. Many say Fireworks' zero-data-retention claims conflict with the data that was stored, and they question Notion's description of its exposed chat transcripts as unattributable. Some find the vague "may have been accessed" wording inadequate for compliance duties, while a few welcome the official bulletins as a start.

  • Notion's unattributable data claim30%
  • Fireworks zero-retention contradiction20%
  • Vague breach wording15%
  • Third-party vendor risk20%
  • Self-hosting alternatives10%

In favour

  • + Official bulletins from Fireworks give a company-side account of the incident

Concerns

  • − Notion's claim that the data is unattributable is seen as too narrow
  • − Fireworks is listed as zero-data-retention, yet data was retained and leaked
  • − Phrases like "may have been accessed" make GDPR obligations hard to assess
  • − Notion's Enterprise-only view of affected members is seen as a paywall

“This is astonishing.”

_fw on Hacker News

“the whole incident response post feels like a huge cop-out.”

alentodorov on Hacker News

“I need to do some GDPR notations bc of them but I won't start running around just bc it "may have been" accessed”

RamblingCTO on Hacker News

Timeline

  1. Fireworks AI notifies customers of the breach affecting data and billing information

  2. Bloomberg Technology

    Nvidia-Backed Fireworks AI Notifies Customers of Its Second Hack in Weeks

  3. Techmeme

    AI infrastructure provider Fireworks says hackers accessed some customers' datasets, incomplete model weights, and billing information over the past month (Anna Tong/Forbes)

  4. Fireworks AI discloses that the investigation uncovered further malicious activity, widening the breach

  5. Hacker News: Front Page

    Fireworks AI security breach impacts Notion and their customers

  6. Hacker News

    140 points · 49 comments

  7. BleepingComputer

    Fireworks AI discloses new breach after cloud provider hack

  8. www.theregister.com - Articles

    Fireworks AI gets burned twice as customer data exposure widens

  9. The Hacker News

    Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights

  10. The Record from Recorded Future News

    AI company Fireworks says hackers stole data, billing info during October breaches

Full coverage · 7 sources

How do you feel about this?

0 Comments