Fireworks AI, a company that runs AI models for other businesses' apps, says an attack it first disclosed in October went further than it knew then, including a second break-in on Oct. 24. In an update posted on Nov. 9, Fireworks says attackers got to customer account and billing details, such as billing addresses, payment history and account balances. For a limited set of accounts, they also reached stored access keys and other secrets, collections of customer data, and incomplete AI model files. Fireworks says it does not store payment card numbers, so those were not affected. It says it is notifying customers whose data was affected. In October it said customers who had no notice had not been identified as affected, based on its investigation at the time.
That is how a break-in at Fireworks reached people who use Notion, not Fireworks. Notion says it used Fireworks to run AI models inside its app and to sort Notion AI chats for Insights, a feature that shows customers how their teams use Notion AI. Fireworks first told Notion on Nov. 2 that a small set of data had been accessed, which Notion found held only test data and no customer data. On Nov. 6 Fireworks said customer data may have been accessed. Notion said on Nov. 12 that the data Fireworks confirmed on Nov. 8 included those chats, from fewer than 1% of Notion workspaces. For most affected workspaces, Notion says, the chats were not labeled with who wrote them or which workspace they came from, though anything people typed into the chats could still say who they are.
Notion cut its systems off from Fireworks on Nov. 3, deleted its data there on Nov. 4, and has switched off Insights and stopped running models through Fireworks. On Nov. 11 it cancelled Notion access keys that people had pasted into the affected chats, and on Nov. 12 it reported other companies' keys found in the chats to those companies. It tells affected customers, who can review the exposed chats inside their workspace, to assume the data was exposed and to change any passwords or keys they pasted into Notion AI during the incident. Notion says workspaces it has not contacted have not been found to be affected and need do nothing for now.
Uber says in a notice filed with California's attorney general that a service provider told Uber on Oct. 9 that an outsider had gotten hold of the provider's internal logins and used them to get into Uber's account with it. Uber says the intruder reached Uber data held with that provider, including the personal information of the people it is now notifying, about 1,873 of them in Rhode Island. A news report says Uber named that provider as Fireworks, and that driver's license details of thousands of drivers in at least three states were taken. Uber is offering the people it notified free credit monitoring and tells them to watch their account statements and credit reports.
Fireworks says it found the first break-in on Oct. 6, when an outsider misused Fireworks' own internal logins. At the time, it said only access keys and other secrets that some customers stored with it were known to have been taken. Then a cloud company that hosted Fireworks' research machines had its own security incident on Oct. 23. On Oct. 24 the attacker used that cloud company to reach Fireworks' development machines and get at more customer data. Fireworks says it caught that the same day and has seen no sign of further successful access to the service customers use since Oct. 25. It says it has found no sign the attack touched its main service for running models, which by default does not keep what customers send it.
Fireworks links the attack to a money-driven criminal group that aims to sell stolen access to AI models. Google's threat researchers describe such schemes as taking over companies' access to AI models and reselling it. In some cases they investigated, victims were hit with fraudulent charges of more than $100,000 in a single day. Fireworks says it notified law enforcement, is working with Palo Alto Networks' Unit 42 security team, and has stopped letting customers upload and download data on their own for some of its model-training and bulk-processing jobs while it investigates. It tells affected customers to replace any outside keys it named with the companies that issued them, since deleting a stored copy does not cancel the key. Fireworks has not said how many customers were affected or named the attackers. It says its findings are based on its investigation so far, which is ongoing and may reveal more. Uber says it has seen no misuse of the data so far.