Notion Customer Data Compromised in Fireworks AI Hack
A recent data breach has compromised customer information stored on Notion’s AI chat transcripts. The attack occurred through Fireworks AI, a cloud platform used by Notion for running and fine-tuning open-source AI models. Notion notified a small set of affected customers that their data had been accessed, but the company declined to disclose how many customers were impacted.
Fireworks AI was hacked twice in October, once through compromised internal credentials and again on October 24 through a third-party cloud provider hosting Fireworks R&D machines. The second incident occurred when attackers executed an unauthorized workload, leading to the compromise of customer data. Fireworks contained the breach on the same day and notified Notion that their AI data had been accessed.
Notion’s investigation found that hackers accessed Notion AI chat transcripts used for the Insights feature, which helps customers understand their AI usage. However, it appears that most of the compromised transcripts were unattributable to a customer or the workspace they came from. “Beyond what’s in the chat transcript itself, there’s no information tying the chat back to workspaces, users or companies,” Notion stated.
While few details are available about the breach, Notion has taken steps to contain and mitigate the damage. The company has contacted affected customers with instructions on how to securely retrieve and review their data. Notion advises customers to treat this data as exposed and rotate any compromised credentials if sensitive information was pasted into AI chat during the incident.
Notion’s use of Fireworks AI for delivering open-weight models has raised questions about the security of AI-powered services. This breach serves as a reminder that even reputable companies can be vulnerable to data breaches, particularly when relying on third-party cloud providers or external platforms.
As customers rely increasingly on AI-powered tools and services, they must be aware of the potential risks associated with these technologies. Notion’s incident highlights the importance of robust security measures and vigilance in protecting sensitive information.
In light of this breach, it is essential for organizations to prioritize data protection and implement robust cybersecurity practices. Users should be cautious when sharing sensitive information online and regularly review their digital footprint to minimize exposure.
Source: SecurityWeek — 2026-11-12