{ "story_id": "21543d824f3d42a78ab39297d53d071c", "desk": "bad-news-beat", "revision": 1, "published_at": "2026-11-12T01:55:06.065Z", "content_hash": "45b7f3516f1546e24281f27ec292ed37bc2414783bea9b3633b91edf7f81ff8f", "hash_basis": "sha256 over `headline\\ndek\\nprose`, plus `\\n` + the canonical citations JSON when any source is placed, plus `\\n#blog` for blogs", "basis": { "headline": "Two breaches at an AI supplier expose Notion users' chat transcripts", "dek": "Fireworks was breached twice in October. Notion learned of it in November and cut the connection. It says under 1% of its users are affected, and tells them to rotate any passwords they typed into a chat.", "prose": "Notion disclosed that a security breach at Fireworks AI exposed some of its users' AI chat transcripts.[^1] Fireworks experienced two data breaches during October.[^2]\n\n## The timeline\n\nFireworks had an earlier breach in early October.[^3] A second, on 23 October, came through a third-party cloud provider.[^4]\n\nNotion received its first alert from Fireworks, about exposed test data, on 2 November.[^5] It cut traffic to Fireworks and deleted the data held by the vendor by 3 November.[^6] Fireworks confirmed on 8 November that customer data, including that of Notion users, had been accessed.[^7]\n\nLaid end to end, that is ten days from the second breach to the first alert, and sixteen to confirmation.\n\n## What was taken\n\nHackers stole billing information and AI-related data from Fireworks.[^8] A limited number of its customer accounts were affected.[^9] All of them have been notified.[^10]\n\nOn Notion's side, the exposed transcripts came from a dataset called Insights, which is now disabled.[^11] Less than 1% of Notion users are affected.[^12]\n\n## What to do\n\nNotion advises affected users to rotate any passwords and API keys that appeared in their chats.[^13] Users who received no notice need take no action, the company says.[^14]\n\n## The supplier\n\nFireworks was founded in 2022 and is based in San Mateo.[^15] It hired Palo Alto Networks' Unit 42 to investigate.[^16]", "cited": "[{\"statement\":\"Notion disclosed a Fireworks AI security breach exposed some Notion AI chat transcripts.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:0\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Fireworks experienced two data breaches during October 2026.\",\"source\":\"therecord.media\",\"instrument\":\"\",\"claim_key\":\"doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:0\",\"url\":\"https://therecord.media/ai-company-fireworks-says-hackers-stole-data-in-oct-attacks\"},{\"statement\":\"Fireworks AI experienced an earlier breach in early October.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:2\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Fireworks AI had a breach via third-party cloud provider on October 23.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:1\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Notion received first Fireworks alert about exposed test data on November 2.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:3\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Notion cut Fireworks traffic and deleted vendor data by November 3.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:4\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Fireworks confirmed customer data access including Notion users on November 8.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:5\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Hackers stole billing information and AI-related data from Fireworks.\",\"source\":\"therecord.media\",\"instrument\":\"\",\"claim_key\":\"doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:1\",\"url\":\"https://therecord.media/ai-company-fireworks-says-hackers-stole-data-in-oct-attacks\"},{\"statement\":\"A limited number of Fireworks customer accounts were affected.\",\"source\":\"therecord.media\",\"instrument\":\"\",\"claim_key\":\"doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:3\",\"url\":\"https://therecord.media/ai-company-fireworks-says-hackers-stole-data-in-oct-attacks\"},{\"statement\":\"All affected Fireworks customers received breach notifications.\",\"source\":\"therecord.media\",\"instrument\":\"\",\"claim_key\":\"doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:4\",\"url\":\"https://therecord.media/ai-company-fireworks-says-hackers-stole-data-in-oct-attacks\"},{\"statement\":\"Exposed Notion transcripts came from the now disabled Insights dataset.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:6\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Less than 1% of Notion users are impacted by this incident.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:7\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Notion advises affected users to rotate passwords and API keys from chats.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:8\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Users without incident notice need no action per Notion.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115767:9\",\"url\":\"https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/\"},{\"statement\":\"Fireworks was founded in 2022 and is based in San Mateo.\",\"source\":\"therecord.media\",\"instrument\":\"\",\"claim_key\":\"doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:9\",\"url\":\"https://therecord.media/ai-company-fireworks-says-hackers-stole-data-in-oct-attacks\"},{\"statement\":\"Fireworks hired Palo Alto Networks Unit 42 to investigate the breaches.\",\"source\":\"therecord.media\",\"instrument\":\"\",\"claim_key\":\"doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:2\",\"url\":\"https://therecord.media/ai-company-fireworks-says-hackers-stole-data-in-oct-attacks\"}]", "kind": "news" }, "receipt_verify": "Ed25519 over the dot-joined string `slice_hash.cursor_from.cursor_to.view.view_version.row_count`; public_key and sig are base64url of the raw 32-byte key / 64-byte signature", "receipt": { "slice_hash": "f5f4444ff68bcb95167ba2b55a985a69dcb8151663bfbcdefe5571fdb688166c", "cursor_from": "ingest:raw_newsroomfloor.stories:f5f4444ff68bcb95", "cursor_to": "ingest:raw_newsroomfloor.stories:f5f4444ff68bcb95", "view": "ingest:raw_newsroomfloor.stories", "view_version": "1", "row_count": 1, "hash_basis": "sha256 over the JSON array of {insertId, json} rows as received (normalized wire shape), computed before the BigQuery forward", "credits": 0.01, "price_per_100_rows_written": 1, "sig": "u-T0j5zpET1XPQTPdyegzxuKVkD5oTS5V3sgmBIC1KvC0YhqmZu5cF4JorNbjyiCu1p0n04z6qxGlkYDcGiBAg", "public_key": "bMUigy8O0jOnBxQ4Sc-5lwhIZ8LQVAhxMbR7qESVuUE", "signer_path": "lakehouse/data-extract/v1", "alg": "Ed25519", "signed": true }, "receipt_note": "the ingest door's signed receipt for this revision, verbatim as the door returned it", "generation_chain": { "art": { "model": "mordiem:flux-2-max", "provider": "mordiem", "requested": "flux-2-max", "director": "@cf/meta/llama-3.3-70b-instruct-fp8-fast", "scene": "A dimly lit server hall with rows of humming machines, a single ember-orange accent from a warning light on a breached server, a small figure in plain clothing walking away from the camera, down a long aisle between the rows, deep shadows cast by the hard directional light.", "style": "custom: a severe monochrome documentary photograph in the manner of an incident report, hard directional light and deep shadow, near-black and bone white with a single ember-orange accent in one object or light, the physical evidence of what went wrong at close range, machinery, paper, a closed door, a wet street, a courthouse step, no faces of real people, no gore, no flames for drama, precise, still, forensic, high contrast film grain, no text", "caption": "Notion cuts connection to breached AI supplier", "painted_at": "2026-11-12T02:21:21.036Z", "image_hash": "ae55977f3add31a30bf924318cd413af8dd0e75317f54164bb700049f80390a0" } }, "cited_facts": [ { "n": 1, "statement": "Notion disclosed a Fireworks AI security breach exposed some Notion AI chat transcripts.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:0", "occurred_at": null, "published_at": null }, { "n": 2, "statement": "Fireworks experienced two data breaches during October 2026.", "source": "therecord.media", "instrument": "", "claim_key": "doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:0", "occurred_at": null, "published_at": null }, { "n": 3, "statement": "Fireworks AI experienced an earlier breach in early October.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:2", "occurred_at": null, "published_at": null }, { "n": 4, "statement": "Fireworks AI had a breach via third-party cloud provider on October 23.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:1", "occurred_at": null, "published_at": null }, { "n": 5, "statement": "Notion received first Fireworks alert about exposed test data on November 2.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:3", "occurred_at": null, "published_at": null }, { "n": 6, "statement": "Notion cut Fireworks traffic and deleted vendor data by November 3.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:4", "occurred_at": null, "published_at": null }, { "n": 7, "statement": "Fireworks confirmed customer data access including Notion users on November 8.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:5", "occurred_at": null, "published_at": null }, { "n": 8, "statement": "Hackers stole billing information and AI-related data from Fireworks.", "source": "therecord.media", "instrument": "", "claim_key": "doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:1", "occurred_at": null, "published_at": null }, { "n": 9, "statement": "A limited number of Fireworks customer accounts were affected.", "source": "therecord.media", "instrument": "", "claim_key": "doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:3", "occurred_at": null, "published_at": null }, { "n": 10, "statement": "All affected Fireworks customers received breach notifications.", "source": "therecord.media", "instrument": "", "claim_key": "doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:4", "occurred_at": null, "published_at": null }, { "n": 11, "statement": "Exposed Notion transcripts came from the now disabled Insights dataset.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:6", "occurred_at": null, "published_at": null }, { "n": 12, "statement": "Less than 1% of Notion users are impacted by this incident.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:7", "occurred_at": null, "published_at": null }, { "n": 13, "statement": "Notion advises affected users to rotate passwords and API keys from chats.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:8", "occurred_at": null, "published_at": null }, { "n": 14, "statement": "Users without incident notice need no action per Notion.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115767:9", "occurred_at": null, "published_at": null }, { "n": 15, "statement": "Fireworks was founded in 2022 and is based in San Mateo.", "source": "therecord.media", "instrument": "", "claim_key": "doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:9", "occurred_at": null, "published_at": null }, { "n": 16, "statement": "Fireworks hired Palo Alto Networks Unit 42 to investigate the breaches.", "source": "therecord.media", "instrument": "", "claim_key": "doc:ai-company-fireworks-says-hackers-stole-data-in-oct-attacks--83902:2", "occurred_at": null, "published_at": null } ], "note": "A signature proves who filed this and that it has not changed since. It never makes a claim true. The dates on cited_facts (occurred_at, published_at) are the forge's, joined at read time; they are not part of the signed basis above." }