Fireworks AI security breach impacts Notion and their customers

Posted by werrett 8 hours ago

Fireworks AI security breach impacts Notion and their customers(www.notion.com)

121 points | 41 commentspage 2

alentodorov 6 hours ago|

the whole incident response post feels like a huge cop-out. “abundance of caution”, the vendor is one of the biggest, so ofc it’s not our fault for choosing them… etc.

sailorganymede 4 hours ago||

I used Notion as a form of social CRM and it really helped me out with that task. Now, all their contacts are out. Nice stuff Notion.

frankotron 7 hours ago||

Forcing us to the Enterprise plan to see which members are affected huh? Classy move Notion.

thinkindie 1 hour ago||

I was able to download the list of potentially affected people and I'm not on enterprised. They made this page available https://app.notion.com/ai/transcript-data

Andugal 7 hours ago||

> Notion AI conversations from 2 members of your workspace may have been affected. Their conversations stay private to them. They have not been proactively emailed. In order for them to access their affected data, you must share this page with them so they can download their own.

Yeah spending the morning figuring out which users are affected and what data is involved. Time well spent. Thanks, Notion.

chinathrow 5 hours ago||

We also have 2 members affected in our org. I wonder if this is a coincidence or just a fixed template.

XVar 5 hours ago||

It's a coincidence, we got the e-mail stating 1 user affected

JumpCrisscross 6 hours ago||

Does this reflect on Fireworks’ culture?

werrett 2 hours ago||

Super poorly IMO. Fireworks' initial breach notification was on Oct 9 [1] and told us we were 'not impacted'. Only for us to find out we were impacted after some of our Anthropic API keys used in Fireworks were 'hijacked'. That in itself took days of investigation and response. I can only imagine Notion are in a similar boat.

To my knowledge we still haven't been formally notified as being included in the Fireworks breach. It makes me extremely skeptical of the " For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models." that they detailed in their Nov 9 update [2].

[1]: https://fireworks.ai/security/bulletins/october-2026-securit...

[2]: https://fireworks.ai/security/bulletins/october-2026-securit...

leafingensemble 2 hours ago||

Yes. $1.505bn at a $17.5bn valuation and can't even make a reliable usage page that does not constantly bug out displaying token usage.

They don't care. The same as Openrouter: $7bn valuation, that service feels to me like about 10 devs total.

They don't care, because it's not about providing a product. Fireworks is about inference as much as a mob nightclub is about drinks.

ankur_misra 37 minutes ago||

[flagged]

RataNova 4 hours ago||

[flagged]

clilog_d 7 hours ago||

[flagged]

Pi9h 4 hours ago||

If you’re looking for a Notion alternative you can self-host, I’m building Docmost. We launched on HN 2 years ago.

Website: https://docmost.com

GitHub: https://github.com/docmost/docmost

vinaygundeti18 8 hours ago|

This is a strong reminder that a company's security is only as strong as its third-party integrations. Even when customer data is handled by trusted platforms, external AI vendors can introduce additional risks. Businesses need to carefully evaluate vendor security, limit the data shared with external services, and maintain transparency when incidents happen. As AI adoption grows, third-party risk management should become a core part of every company's security strategy.