Notion Cuts Fireworks After Hack Hit Under 1% of Workspaces

Notion says a security incident at Fireworks AI, the inference provider it used for AI features, is impacting “<1% of Notion workspaces”, and that the exposed dataset included Notion AI chat transcripts, according to a security advisory Notion updated on 10 November.

Notion says it disconnected its systems from Fireworks by the morning of 3 November and deleted all data in the Fireworks system. It has disabled its Insights feature and says it is “no longer serving open-weight models through Fireworks”. Fireworks first notified Notion on 2 November; Notion contacted impacted customers on 9 November, seven days later by our arithmetic.

Business Pill · Embedded Dependency

An evergreen Business Engineer explainer on embedded dependencies: what is inside what you buy. It teaches the general idea only and does not discuss the Notion or Fireworks incident.

What Notion Says Was Exposed

Notion says the dataset Fireworks gave it on 8 November included Notion AI chat transcripts used for the Insights feature, which “for the vast majority of impacted workspaces were unattributable”. Notion says that means the chats were not labelled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.

Notion says no other Notion features were affected. On 2 November, it says, Fireworks reported that a small set of data had been accessed; Notion found that set was Notion AI synthetic testing data, with no Notion AI customer data involved. On 6 November Fireworks told Notion that malicious actors may have accessed potential customer data.

What Was Posted on X

The Information reporter Stephanie Palazzolo (@steph_palazzolo) posted at 20:33 UTC on 10 November that Notion “was also affected” and that, unlike Harvey, “it seems like their customers’ data was affected by the fireworks hack”, quoting her post on The Information’s article. Notion’s own security advisory is the primary source for this piece.

Seven Days From Notice to Customers

Notion’s timeline runs from Fireworks’ first notice on 2 November to Notion’s outreach to impacted customers on 9 November. In between, Notion disconnected from Fireworks by the morning of 3 November, Fireworks warned of potential customer data on 6 November, and Fireworks confirmed the final impacted dataset on 8 November.

Notion recommends that affected customers treat the data as if it were exposed. If they pasted sensitive information, passwords, API keys or other credentials into Notion AI during the incident, it says, they should rotate them. Affected customers can retrieve and review the impacted data inside their workspace, with instructions sent by email, Notion says.

How Notion Used Fireworks

Notion says it used Fireworks for classification jobs behind Insights, a feature that helps customers understand their own AI usage, and as a general inference provider to serve open-weight models inside its product. Notion describes Fireworks as “one of the most used global AI infrastructure platforms powering tens of thousands of customers and used by hundreds of thousands of developers”.

Fireworks’ own update says a third-party cloud provider that hosted its R&D machines had a security incident on 23 October, and that on 24 October the unauthorized third party used it to reach Fireworks development machines and run a workload that led to additional customer data impact. From that 24 October intrusion to Notion’s first notice on 2 November was nine days, by our arithmetic.

Fireworks’ first bulletin dates an earlier incident to 6 October. We covered that update in our piece on the second Fireworks breach.

What The Information Reported

The Information reporter Stephanie Palazzolo posted on X at 20:33 UTC on 10 November that Notion “was also affected” and that, unlike Harvey, “it seems like their customers’ data was affected by the fireworks hack”. The Information had reported that Fireworks told customers including Harvey it had been hit with a hack that exposed customer data, and that some customers are considering moving their business off the platform.

Fireworks says it has not detected any impact to its Inference, Training SDK and Nexus products, which are zero data retention by default, and that its investigation is ongoing. For the first incident’s cost to one customer, see our piece on a stolen key that ran 1.7M Claude calls.

The Structural Read

As we read the advisory, the exposure ran through one feature rather than Notion’s own systems: Notion says it used Fireworks for classification jobs behind Insights and that this was not a breach of its systems, yet it is the company contacting the affected customers.

As we read the two timelines together, the gap sits upstream: Fireworks says the intruder reached its development machines on 24 October, and Notion says Fireworks first notified it on 2 November, nine days later by our arithmetic.

Three Implications

FOR NOTION CUSTOMERS Notion tells affected customers to treat the data as if it were exposed and to rotate any credentials they pasted into Notion AI during the incident.

FOR FIREWORKS Notion says it is no longer serving open-weight models through Fireworks; The Information reported that some Fireworks customers are considering moving their business off the platform.

FOR AI APP BUILDERS Notion says that beyond what is in each transcript, there is no information tying the chats back to workspaces, users or companies.

The Business Engineer Lens

This story maps onto the Business Engineer framework The State of The Inference Economy.

The framework argues: “Training builds the brain. Inference is the brain working.”

As we read it, Notion’s chat transcripts sat in that working layer, run through a third-party provider; when the provider was breached, the application owner disabled the feature and stopped serving models through it. The framework predates the incident and does not discuss it.

What Is Not Established

Notion’s advisory gives the share of workspaces only as under 1% and gives no count of workspaces, users or chat transcripts. It does not say how long the transcripts were held at Fireworks. Fireworks’ update does not name Notion. Both companies say their investigations are ongoing.

Notion says this “was not a breach of our systems”. Neither statement names the attackers; Fireworks says the evidence indicates links to a financially motivated cybercriminal group aimed at selling unauthorized access to large language models.

The Bottom Line

Notion says the Fireworks incident reached under 1% of its workspaces and exposed Notion AI chat transcripts that were mostly unattributable. It has cut its systems off from Fireworks, disabled Insights and stopped serving open-weight models through the provider. It contacted impacted customers seven days after Fireworks’ first notice.