> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Notion AI chats were exposed in the Fireworks breach. Who's affected and what to do now
- URL: https://www.skimwire.com/notion-ai-fireworks-breach-chat-transcripts-what-to-do/
- Published: 2026-11-13T13:34:53.000Z
- Updated: 2026-11-13T13:34:53.000Z
- Description: A breach at AI vendor Fireworks exposed Notion AI chat transcripts in under 1% of workspaces. The timeline, what leaked, and the steps to take today.
- Author: Iris Kade
- Tags: Security

## The skim

- **What happened:** hackers who broke into AI infrastructure company Fireworks AI got hold of some Notion AI chat transcripts. Notion says fewer than 1% of workspaces are affected. For most of them, it says the chats weren't labeled with who wrote them or which workspace they came from.
- **Who needs to act:** only workspaces Notion has contacted, Notion says. If you got the email, treat anything you typed into Notion AI during the incident window as exposed, and rotate any passwords, API keys or other credentials you pasted in.
- **The bigger lesson:** your AI chats can live on servers run by companies you've never heard of. Notion says Fireworks had committed to zero data retention, yet the transcripts were still in stored data that got breached.

## What happened, in order

The breach didn't start at Notion. In its [Nov. 9 security update](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=skimwire.com), Fireworks says a third-party cloud provider hosting its research machines "experienced a security incident on October 23." On Oct. 24, the attacker used that access to reach Fireworks development machines and run an unauthorized workload. Fireworks ties the attack to a financially motivated group that sells stolen access to AI models, a practice known as "LLMJacking."

Notion's [security advisory](https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor?ref=skimwire.com) lays out what happened next:

| Date (2026) | What happened                                                                                                             |
| ----------- | ------------------------------------------------------------------------------------------------------------------------- |
| Oct. 23–24  | Fireworks' cloud provider is breached; the attacker reaches Fireworks development machines (per Fireworks).               |
| Nov. 2      | Fireworks tells Notion a small dataset was accessed. Notion says it held only synthetic test data.                        |
| Nov. 3–4    | Notion cuts its systems off from Fireworks and deletes all its data there.                                                |
| Nov. 6      | Fireworks says customer data may have been accessed after all.                                                            |
| Nov. 8      | Fireworks confirms the final affected dataset. It includes Notion AI chat transcripts used for Notion's Insights feature. |
| Nov. 9      | Notion contacts affected customers.                                                                                       |
| Nov. 11     | Notion revokes Notion API keys it found inside affected messages.                                                         |
| Nov. 12     | Notion reports exposed third-party API keys to the companies that issued them.                                            |

## What was exposed, and what wasn't

Notion used Fireworks for two jobs. It ran classification for **Insights**, a feature that shows workspace admins how their teams use AI, and it served some open-weight models inside Notion AI. The stolen data came from the Insights side. TechCrunch reports that Notion says the transcripts include "any input to or output from the model that was written to the chat." Anything you typed or pasted into Notion AI could be in there.

On the limits of the damage, Notion says:

- For most affected workspaces, the chats are "unattributable." They weren't labeled with a user or workspace, and they didn't include tool-call results.
- "No other Notion features were affected." Your pages and databases weren't part of this, because the breach wasn't in Notion's own systems.
- Insights is switched off while Notion investigates, and Notion no longer serves open-weight models through Fireworks.

Fireworks separately says the breach also hit billing details like addresses and invoice history (but not card numbers) and, for some customers, datasets and incomplete model weights. TechCrunch notes Fireworks has tens of thousands of customers, including Harvey and Cursor. Notion is the first big consumer-facing name confirmed to have exposed user content.

"Unattributable" isn't the same as anonymous. If someone pasted a client name, an email signature or an API key into a chat, the text itself can identify them. That's why Notion is revoking keys it found in the messages.

## What to do now

1. **Check for the email.** Notion says it has contacted every affected customer, and "if you haven't heard from us... no action is needed right now." Search your inbox, and your workspace owner's, for a message from Notion about the Fireworks incident.
2. **If you're affected, review the data.** BleepingComputer reports that workspace owners can review it through a "Security incident review" in Notion's desktop web interface. They can also share a link that lets members download their own transcripts.
3. **Rotate what you pasted.** Change any password, API key, token or other credential that ever went into a Notion AI chat in that window. Notion has already revoked Notion API keys it found. Keys from other services are up to you, even though Notion says it has reported them to the issuers.
4. **Watch for targeted phishing.** If your chats included internal plans or customer details, warn your team. A convincing scam email is easier to write when an attacker knows what you're working on.
5. **Not affected? Still clean up.** Make it a rule never to paste secrets into any AI chat. Use a password manager or a proper secrets vault instead. Our [passkeys guide](https://www.skimwire.com/how-to-set-up-passkeys-iphone-android-windows/) helps take passwords out of the picture entirely.

## Why this matters beyond Notion

Here's the uncomfortable part. VentureBeat points out that Fireworks' own documentation says it has "Zero Data Retention by default." Its policy page adds that "a few features do store customer content, such as stored responses, batch jobs, and training." The Notion transcripts sat on that stored side. BleepingComputer reports that Notion's FAQ says Fireworks had contractually committed to zero data retention for Notion data. A zero-retention promise covers the default path, not every feature a vendor uses.

It's the same supply-chain pattern we saw with [Railway's secrets breach](https://www.skimwire.com/railway-breach-customer-secrets-rotate-keys/) in October. You trust one app, it trusts a vendor, and that vendor's cloud provider is where things go wrong. Most AI features in the apps you use rely on outside model providers. Few apps tell you which ones, or what they keep.

## Our take

Notion's response has been fast and fairly open. It published a dated timeline, revoked keys and gave affected users their data back to review. The actual risk to most people looks small. Fewer than 1% of workspaces are affected, and most chats can't be tied to a user. But Notion first told customers only synthetic test data was involved, and that changed within days. That's a reminder that early breach statements are provisional.

**Act, watch or relax?**

- **Act today** if you or your workspace owner got Notion's notice. Review the data and rotate every credential that was in those chats.
- **Watch** if you're an admin of a big workspace that uses Notion AI heavily. Keep an eye on [Notion's advisory](https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor?ref=skimwire.com), since its investigation is still ongoing.
- **Relax, but change your habits,** if you got no notice. Nothing to do for this incident. Just stop pasting passwords and keys into AI tools, any AI tool.

*Skimwire reviewed Notion's and Fireworks' published advisories. We haven't seen the affected data, and Notion hasn't said how many customers were notified.*

*Sources:* [*Notion security advisory*](https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor?ref=skimwire.com) *(updated Nov. 12–13, 2026);* [*Fireworks AI security update*](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=skimwire.com) *(Nov. 9, 2026);* [*TechCrunch*](https://techcrunch.com/2026/11/12/cyberattack-on-fireworks-ai-allowed-hackers-to-access-notion-customers-chat-transcripts/?ref=skimwire.com)*;* [*BleepingComputer*](https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/?ref=skimwire.com)*;* [*SecurityWeek*](https://www.securityweek.com/notion-customer-data-compromised-in-fireworks-ai-hack/?ref=skimwire.com)*;* [*VentureBeat*](https://venturebeat.com/security/attackers-breached-the-fireworks-ai-storage-where-notion-ai-chats-sat-outside-zero-data-retention?ref=skimwire.com)*.*