Fireworks AI expands October breach: billing data, datasets and partial model weights exposed via cloud provider intrusion
Fireworks AI expanded its disclosure on November 9, 2026, after an October intrusion that began with misused internal credentials and grew through a second path. The first stage, detected on October 6, let an attacker read environment variables in evaluation jobs, exposing API keys and tokens of some customers (theregister.com). The second stage began when a third-party cloud provider hosting Fireworks' R&D machines was breached on October 23, and the intruder used that foothold on October 24 to reach development machines and run an unauthorized workload (fireworks.ai). The exposed data covers resource metadata, billing records without payment card numbers, and, for a limited set of accounts, secrets, datasets and incomplete model weights (fireworks.ai). The company links the activity to a financially motivated group selling access to LLMs through illicit gateways, but has not named it, and reports no impact on its Inference, Training SDK and Nexus products (fireworks.ai). The investigation is ongoing and the number of affected customers has not been disclosed (theregister.com).
Detalhes técnicos
- Stage 1 (October 6 to 9): unauthorized use of internal credentials, with access to secrets used in evaluation jobs. At the time, Fireworks reported no access to models, datasets, training data, inference traffic or personal information (theregister.com).
- Stage 2 (October 23 to 25): the cloud provider's incident on October 23 was the entry point; the attacker's unauthorized workload ran on Fireworks development machines on October 24 and was detected the same day. As of October 25 no further successful access to the customer-facing platform had been detected (fireworks.ai). The bulletin does not name the cloud provider (fireworks.ai).
- Data categories: resource metadata (identifiers, display names, descriptions, creation times); billing data (billing and shipping addresses, invoices, payment history, balances, credit usage); and, for certain customers, a subset of incomplete model weights and datasets (fireworks.ai).
- Attacker objective: Fireworks CEO Lin Qiao said attackers were not after weights and that most downloads were partial and stopped (theregister.com).
- Downstream exposure: Notion told Render that some Notion AI chat sessions may have been exposed; Notion said the transcripts were not linked to users or workspaces, though the chat content itself could contain identifying details (theregister.com).
Remediação
- Fireworks' own actions: revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted unauthorized network paths, isolated affected systems, tightened access to storage and analytics, and strengthened logging and monitoring. It also disabled self-serve dataset upload and download for Batch Inference and dataset-based training while the investigation runs (fireworks.ai).
- Engagement: the company notified law enforcement and works with Palo Alto Networks Unit 42 on forensics and hardening (fireworks.ai).
- Customer actions (analyst recommendation): rotate any Fireworks API keys and any third-party secrets stored on the platform, since deleting a stored secret does not revoke the underlying credential; review jobs, datasets, users and keys for unfamiliar activity; and contact [email protected] (fireworks.ai).
Linha do tempo
-
Fireworks AI expands October breach: billing data, datasets and partial model weights exposed via cloud provider intrusion
ler a análise desta fonte ocultar
Fireworks AI expanded its disclosure on November 9, 2026, after an October intrusion that began with misused internal credentials and grew through a second path. The first stage, detected on October 6, let an attacker read environment variables in evaluation jobs, exposing API keys and tokens of some customers (theregister.com). The second stage began when a third-party cloud provider hosting Fireworks' R&D machines was breached on October 23, and the intruder used that foothold on October 24 to reach development machines and run an unauthorized workload (fireworks.ai). The exposed data covers resource metadata, billing records without payment card numbers, and, for a limited set of accounts, secrets, datasets and incomplete model weights (fireworks.ai). The company links the activity to a financially motivated group selling access to LLMs through illicit gateways, but has not named it, and reports no impact on its Inference, Training SDK and Nexus products (fireworks.ai). The investigation is ongoing and the number of affected customers has not been disclosed (theregister.com).
Technical Details
- Stage 1 (October 6 to 9): unauthorized use of internal credentials, with access to secrets used in evaluation jobs. At the time, Fireworks reported no access to models, datasets, training data, inference traffic or personal information (theregister.com).
- Stage 2 (October 23 to 25): the cloud provider's incident on October 23 was the entry point; the attacker's unauthorized workload ran on Fireworks development machines on October 24 and was detected the same day. As of October 25 no further successful access to the customer-facing platform had been detected (fireworks.ai). The bulletin does not name the cloud provider (fireworks.ai).
- Data categories: resource metadata (identifiers, display names, descriptions, creation times); billing data (billing and shipping addresses, invoices, payment history, balances, credit usage); and, for certain customers, a subset of incomplete model weights and datasets (fireworks.ai).
- Attacker objective: Fireworks CEO Lin Qiao said attackers were not after weights and that most downloads were partial and stopped (theregister.com).
- Downstream exposure: Notion told Render that some Notion AI chat sessions may have been exposed; Notion said the transcripts were not linked to users or workspaces, though the chat content itself could contain identifying details (theregister.com).
Remediation
- Fireworks' own actions: revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted unauthorized network paths, isolated affected systems, tightened access to storage and analytics, and strengthened logging and monitoring. It also disabled self-serve dataset upload and download for Batch Inference and dataset-based training while the investigation runs (fireworks.ai).
- Engagement: the company notified law enforcement and works with Palo Alto Networks Unit 42 on forensics and hardening (fireworks.ai).
- Customer actions (analyst recommendation): rotate any Fireworks API keys and any third-party secrets stored on the platform, since deleting a stored secret does not revoke the underlying credential; review jobs, datasets, users and keys for unfamiliar activity; and contact [email protected] (fireworks.ai).