Notion AI chat transcripts exposed in Fireworks AI breach

What happened in the Fireworks AI breach?

On 23 October, an attacker got into a development environment through a third-party cloud provider. Resource metadata, billing information, model weights and some customers' datasets were compromised. Earlier in October, Fireworks had already been hit by a similar incident, in which hackers reached environment variables holding API keys and tokens for a limited number of accounts.

Notion learned about the transcript leak on 2 November. Fireworks told it that an exposed dataset held only synthetic test data. Notion blocked data transfers to Fireworks, deleted everything from the supplier's systems and halted model training by 3 November. On 8 November, Fireworks confirmed that customer data, including that of Notion users, had in fact been accessed.

Fireworks runs some of the open-weight models available in Notion AI. It also analyses saved conversations for Insights, the feature that lets workspace admins see how their teams use AI. The leaked transcripts came from Insights, which is now switched off. According to Notion, the chats did not show who held them or which workspace they came from, and they contained no tool call results. Notion also says its contract required Fireworks not to retain its data.

What should Notion users do?

Workspace owners should open the "Security incident review" section in the desktop web version of Notion. They can also share a link that lets members download their own transcripts.

If you were affected, Notion advises changing passwords, API keys and any other credentials you typed into those chats. If neither you nor your workspace owner received a notification, Notion says no action is needed for now.