Notion, a widely used productivity and collaborative workspace platform, recently alerted a select group of customers about a data breach that compromised their information. The breach was linked to Fireworks AI, a cloud platform known for running and fine-tuning open-source AI models. Fireworks AI experienced two separate security incidents in October. The first breach involved compromised internal credentials, while the second incident, occurring on October 24, involved unauthorized access through a third-party cloud provider hosting Fireworks R&D machines. This latter breach was associated with a rise in LLMJacking activity, where attackers executed an unauthorized workload, leading to the exposure of customer data.
Fireworks AI managed to contain the breach on the same day and informed Notion about the compromised data on November 2. Notion's investigation found that hackers accessed AI chat transcripts used for the Insights feature, which is designed to help users understand their AI usage. However, less than 1% of Notion workspaces were impacted, and most of the accessed transcripts could not be directly linked to any specific customer or workspace.
Notion stated that beyond the information within the chat transcripts, there was no data connecting these chats back to specific workspaces, users, or companies. The company has reached out to affected customers, providing guidance on how to securely access and review the data within their workspaces. Notion also advised customers to consider this data as exposed and recommended rotating any sensitive credentials, such as passwords or API keys, that may have been shared during the incident. SecurityWeek has reached out to Notion for further details and will provide updates as available.
