The digital workspace platform Notion announced that it suffered an indirect security breach resulting from a hack experienced by its AI infrastructure provider, Fireworks AI, which led to the exposure of Notion AI chat texts for a limited number of workspaces.
Breach Details
The incident began when attackers managed to access Fireworks AI's development environment via a third-party cloud provider on October 23, where they gained access to resource metadata, billing information, model weights, and datasets belonging to some customers. This is the second incident for the company during October, as it had previously suffered another hack affecting environment variables containing API keys and secret tokens.
Notion discovered the existence of exposed chat texts after receiving an alert on November 2, and the company responded immediately by cutting off traffic to Fireworks AI, deleting all data from the provider's systems, and halting training operations by November 3. However, Fireworks AI confirmed on November 8 that customer data had indeed been accessed.
What Does This Mean for Users?
Notion clarified that the leaked data came specifically from the Insights feature dataset, a tool that allows workspace administrators to monitor how their teams use artificial intelligence. The company confirmed that the vast majority of affected chats were "unattributable," meaning they were not linked to the identity of the author or the workspace they belong to, nor did they contain tool invocation results.
Required Protection Measures:
- Fewer than 1% of Notion users were affected by this incident.
- Owners of affected workspaces can review data through the Notion web interface and download their chat texts.
- The company advises affected users to change passwords, API keys, and any other credentials entered into the affected chats.
- If a user or workspace owner has not received a notification, this generally means they are not within the affected scope.
This incident highlights the risks associated with software supply chains and reliance on AI infrastructure providers, where data privacy remains an ongoing challenge even with contractual commitments not to retain data.