Fireworks AI Says Hackers Reached Billing Data and Incomplete Model Weights in Widened Breach
Fireworks AI has expanded its October breach disclosure, saying attackers who came in through a cloud vendor reached customer billing data and, for some accounts, datasets and incomplete model weights.
A month ago, Fireworks AI told customers the damage from its October breach stopped at stored secrets. Now the list is longer. In an update to its security bulletin dated Nov 9, the AI inference company says it has found impacts to account and billing information, and for a limited set of accounts, to secrets, datasets and incomplete model weights.
That is a sharp turn from the original Oct 9 bulletin. Back then, Fireworks said it had "not detected evidence of unauthorized access to customer models, datasets, training data, personal information, or inference traffic" and that an unauthorized third party had reached environment variables used in evaluation jobs in a limited number of customer accounts. The new update says that at the time, only Fireworks stored secrets were known to have been accessed. Since then, the picture has widened.
A second door through a cloud vendor
The update also describes a fresh route in. Fireworks says a third-party cloud provider that hosted its R&D machines suffered a security incident on Oct 23. The next day, according to the company, the intruder used that foothold to reach Fireworks development machines and run an unauthorized workload that "led to additional customer data impact."
Fireworks says it caught that activity the same day, moved to close known critical vulnerabilities, and has not detected further evidence of successful unauthorized access on the platform customers use as of Oct 25. It does not name the cloud provider.
The affected internal application, per the bulletin, gave access to three categories of information. There was resource metadata such as identifiers, display names and descriptions. There was billing information, including billing and shipping addresses, invoice and payment history, account balances and credit usage. And for certain customers, a subset of incomplete model weights and datasets were accessed. Fireworks says it does not store payment card numbers and that they were not impacted.
Fireworks is notifying the customers whose data was hit, and Bloomberg Law reports those notices went out on Monday. Nothing in either source says every Fireworks customer was affected. The company says it has detected no impact to Inference, Training SDK or Nexus, which it describes as zero data retention by default, while warning that its investigation is ongoing and "may reveal additional information."
Follow the tokens
The company says the evidence points to a financially motivated cybercriminal group that sells tokens from unauthorized access to large language models to illicit routing gateways, a racket known as LLMJacking. In plain terms, the prize is stolen AI compute that can be resold.
Fireworks was the first name on the list of AI developer platforms that Wiz said were hit in October, which we covered when that roundup landed. This update is different. It is the company itself revising what it lost, and the revision goes well past API keys.
Bloomberg Law called it the company's second known hack in a matter of weeks. Fireworks has more than 10,000 customers, including Harvey, Notion and Cursor, according to its website as cited by Bloomberg Law. A spokesperson told Bloomberg Law the company is
"actively working with our customers to manage the incident, including Notion, Cursor and others" Fireworks spokesperson, to Bloomberg Law
The cleanup list in the bulletin is long. Working with Palo Alto Networks Unit 42, which Fireworks brought in for forensic analysis after notifying law enforcement, the company says it revoked and replaced credentials and service accounts, stripped unnecessary elevated privileges, isolated affected systems and tightened access to storage and analytics. It has also switched off self-serve dataset uploads and downloads for Batch Inference and dataset-based training while the investigation runs.
The broader lesson is an uncomfortable one. A first disclosure is a snapshot, not a ceiling, and Fireworks has now shown how far a snapshot can drift in a month.
