Notion AI Data Breach: Fireworks AI Hack Exposed Chat Transcripts in Under 1% of Workspaces, and What to Rotate Now

Notion says attackers who broke into Fireworks AI, an outside company that ran parts of Notion AI, got hold of Notion AI chat transcripts from fewer than 1% of Notion workspaces. If your team types client details, passwords or API keys into an AI assistant, this kind of exposure can happen even when the app you signed up for was never hacked itself.

Notion has emailed the customers it identified as affected and is telling them to treat the data as exposed. Below is what the two companies have confirmed, what they have not, and what to do this week.

What happened with Notion AI and Fireworks AI

Fireworks AI is an AI infrastructure company: it runs AI models on its own servers for other software companies. Notion's security advisory says Notion used Fireworks for two things. The first was classification jobs behind the Notion AI Insights feature, which shows customers how their teams use AI. The second was general inference, serving open-weight models inside Notion.

Fireworks first disclosed a security incident in a bulletin published October 9, 2026. It said an unauthorized party used internal Fireworks credentials to reach environment variables used in evaluation jobs in a limited number of customer accounts, and that it believed API keys and tokens stored as secrets in some of those accounts were captured.

In an update dated November 9, Fireworks said the impact had grown. It now includes account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Fireworks also said a third-party cloud provider hosting its research and development machines had its own security incident on October 23. On October 24 the unauthorized party used that incident to reach development machines and run a workload that caused additional customer data impact.

Notion's advisory picks up the story from there. On November 2, Fireworks told Notion that malicious actors had accessed a limited set of data, which Notion found to be synthetic testing data with no customer data in it. On November 6, Fireworks reported that customer data may also have been accessed. On November 8, Fireworks confirmed the final impacted dataset, which included Notion AI chat transcripts used for Insights.

What is confirmed and what is not

Confirmed by Notion:

• Fewer than 1% of Notion workspaces are affected, and Notion contacted those customers on November 9.
• The exposed data includes Notion AI chat transcripts used for the Insights feature.
• For most affected workspaces the transcripts were unattributable: no author or workspace labels and no tool call results.
• Notion disconnected from Fireworks on November 3, deleted the data held in that system, disabled Insights and stopped serving open-weight models through Fireworks.
• Notion says no other features were affected.

Confirmed by Fireworks:

• Attackers reached account and billing data and, for some customers, secrets, datasets and incomplete models. Fireworks does not store payment card numbers, and they were not affected.
• Fireworks detected no impact on its Inference, Training SDK or Nexus services, which it says keep no customer data by default (zero data retention).
• Fireworks says the evidence links the incident to a financially motivated criminal group that sells tokens gained through unauthorized access to AI models to illicit routing gateways. The bulletin uses the term 'LLMJacking' in that description.
• Fireworks notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis.

Not known:

• How many organizations or people make up the affected 1%. Notion gives a percentage, not a count.
• Which of Fireworks' intrusion paths reached the Notion data. The Fireworks bulletin does not name Notion.
• Whether the transcripts have been published, sold or misused. Neither company says.
• The final scope. Both companies describe their investigations as ongoing.

Notion AI breach timeline

What to do this week

Why this matters for a company network or website

Most businesses that turned on Notion AI picked Notion, not Fireworks. But AI features often pass your text to other companies behind the scenes, known as subprocessors, and a breach at one of them lands on you anyway.

The transcripts matter because of what people type into them. Staff paste in contract terms, customer emails, server logins and API keys for the website, payment processor or cloud account. A leaked transcript with a live key in it is a way into those systems, which is why Notion's main advice is to rotate credentials, not just read a notice.

There is a second lesson in the details. Fireworks says its inference service keeps no customer data by default, yet the Notion transcripts were held as a dataset for a separate job behind an analytics feature. A promise about one service does not always cover every way your data gets used.

Questions to ask any AI vendor

• Which outside companies receive our prompts and outputs, and for which features?
• Are prompts stored, for how long, and is that different for analytics or usage features?
• Can our admins turn off features that send data to extra processors?
• How quickly will you tell us if one of your subprocessors is breached?
• Can our admins see and delete AI chat history for the whole workspace?

Notion AI breach questions people are asking

Was my Notion workspace affected?

Notion says it contacted every customer it identified as affected on November 9. If your workspace owner received no email, Notion says no action is needed for now, though its investigation continues.

What data was exposed in the Notion AI breach?

Notion AI chat transcripts used for the Insights feature. For most affected workspaces they carried no author or workspace labels. Treat anything typed into those chats, including pasted passwords or keys, as exposed.

Was Notion itself hacked?

Notion describes it as a security incident involving a third-party AI vendor. The data was accessed at Fireworks AI, where Notion had sent it for processing.

What is Fireworks AI?

An AI infrastructure company that runs AI models for other software products. It disclosed the incident on October 9, 2026 and expanded that disclosure on November 9.

Do I need to change my Notion password?

Notion has not asked customers to change their Notion passwords. It has asked affected customers to rotate any credentials pasted into Notion AI during the incident.

Is Notion AI Insights still available?

No. Notion disabled Insights during the investigation and no longer serves open-weight models through Fireworks.

The bigger lesson

Every AI feature you switch on brings in vendors you never picked. The safe habit is the same everywhere: know where your data goes, keep secrets out of chat boxes, and know how to rotate a key quickly when a notice arrives.

For an outside review of where your company's data goes, see our security hardening work or request a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Notion: Security incident involving a third-party AI vendor; Fireworks AI: Update on October 2026 security incident; Fireworks AI: October 2026 security incident.