San Mateo’s Fireworks says hackers reached more than first disclosed, including billing records and some unfinished AI models

Fireworks, a fast-growing San Mateo company that runs artificial intelligence models for other businesses, said Nov. 9 that a hack it disclosed in October reached far more customer data than it first said.  The attackers got customer account and billing information and, for some customers, stored access keys, datasets and incomplete AI models, the company said in an updated security notice.

Fireworks, founded by the team behind PyTorch, a widely used free toolkit for building AI, rents out computing power and software so companies can customize and run open AI models on their own data.  Customers include Uber, Shopify and Revolut, it says.  In July it raised $1.5 billion at a $17.5 billion value and said its annualized revenue had passed $1 billion.

What happened

On Oct. 9, Fireworks said an outsider had misused internal company credentials to grab secrets, such as access keys and tokens stored for testing jobs, from a limited number of customer accounts.  At the time it said it had found no sign that customer models, datasets or personal information had been reached.

The new notice says that has changed.  Investigators also found that account and billing records were reached, including billing and shipping addresses, invoice and payment history, account balances and credit use.  Fireworks does not store payment card numbers, and those were not affected, it said.  For some customers, part of their unfinished AI models and datasets were also accessed.  Separately, a cloud provider that hosted Fireworks research machines was hacked Oct. 23, and the next day the intruder used it to reach Fireworks development machines, the company said.  Fireworks said it has found no further successful break-ins on its customer platform since Oct. 25.  It has not said how many customers were affected.

Who did it and why

The evidence points to a money-driven criminal group that steals access to AI models and resells it to illicit services, a scheme known as “LLMjacking,” Fireworks said.  LLM stands for large language model, the kind of AI behind chatbots.  Fireworks said it is working with Palo Alto Networks’ Unit 42 security team, has told law enforcement, replaced company credentials, cut off risky network paths, and turned off self-serve dataset uploads and downloads while it investigates.  It said it has found no impact on its main service for running models, which keeps no customer data by default.

Notion users

Notion, maker of a popular note-taking and work app, said fewer than 1% of its workspaces were affected.  The exposed data included Notion AI chat transcripts used for a feature called Insights, most of which could not be tied to a person or workspace, Notion said.  Notion has disconnected from Fireworks, deleted its data there and turned off Insights.  It advises affected customers, who were contacted by email, to change any passwords or keys they pasted into Notion AI during the incident.

Source:  Fireworks security update, Nov. 9, 2026, Fireworks original security notice, Oct. 2026, Notion security advisory, updated Nov. 9, 2026 and Fireworks funding announcement, July 16, 2026.