Fireworks AI says its October breach was broader than initially disclosed, with attackers gaining access to customer account and billing information as well as some datasets, incomplete model weights and secrets. Notion, the popular productivity and note-taking app, disclosed that it was impacted in the breach but "fewer than 1% of Notion workspaces" were involved. "Upon analysis of the new data, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable," it said. "'Unattributable' means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results." The Hacker News reports: In a notice published on October 10, 2026, [Fireworks AI] said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized third-party to access environment variables used in evaluation jobs in a limited number of customer accounts. The activity was detected on October 6, 2026, at 9 a.m. PDT. [...] The latest bulletin from the company reveals that the scope of the breach may have been broader than previously thought. The company said attackers reached its development environment via an unnamed third-party cloud provider that hosted Fireworks research and development (R&D) machines on October 23, 2026. "On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact," it added. "As of October 25, we have not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use." The breach is said to have provided access to the following types of information: [Resource metadata; Billing information; and Model weights and datasets]. Fireworks AI said payment card numbers are not stored by the company and were not impacted by the security incident. It also said it's alerting customers whose data was impacted.

Read more of this story at Slashdot.