Notion, the note-taking and shared-documents app, confirmed on November 9, 2026, that some users’ AI chats were in data that hackers accessed at one of its vendors. It recommends that affected customers treat those chats as exposed and change any passwords and access keys pasted into them.
The affected chats are conversations with Notion AI, the assistant built into the app. Notion estimates that fewer than 1% of its workspaces are affected. A workspace is the shared space where a team keeps its pages in Notion. The company says its own systems were not breached.
The vendor, Fireworks AI, is a startup that runs AI models for other software companies. That same day, November 9, Fireworks expanded its account of a breach it first disclosed in early October. The hackers reached billing data. For a limited number of accounts, they also reached datasets, unfinished AI models, and stored secrets, meaning saved credentials.
Chats collected for Notion’s Insights feature
Notion gathered the affected chats for Insights, a tab that shows the people who run a workspace how their team uses AI. Only owners and admins on the Business and Enterprise plans can open it, according to Notion’s help center. Notion used Fireworks to sort those chats into categories. The results fed the Insights statistics on use cases and conversation counts.
Notion calls the chats “unattributable” for the vast majority of affected workspaces. They were not labeled with the name of the person who wrote them or the workspace they came from. They also left out the output of any tools the assistant used during a conversation.
According to Notion, nothing beyond the text of a chat ties it to a workspace, a user, or a company. The Register, a tech news site, noted that the text itself can still contain details that identify someone. It cited comments from Reddit users.
Notion has turned off Insights while it investigates. Its help page now reads: “Insights is temporarily paused.” The company has also stopped using Fireworks to run open-weight models in its product. These are AI models whose trained parameters are published openly.
Notion’s timeline from November 2 to 10
Fireworks told Notion on the evening of November 2 that hackers had accessed a small set of data, according to Notion’s security advisory. That first set turned out to be synthetic, or made-up, test data for Notion AI, with no customer data. As a precaution, Notion disconnected from Fireworks by the morning of November 3. It deleted all of its data stored with Fireworks and cut off all communication with the vendor’s systems.
On November 6, Fireworks reported that customer data may also have been accessed. On November 8, Fireworks confirmed the final set of affected data. Notion contacted the affected customers on November 9. On November 10, Notion posted a revised version of its advisory, with no change to the facts, according to the company.
Affected customers received instructions by email for reviewing the data in question inside their workspace. Notion says a workspace that has not heard from it has not been identified as affected so far. The investigation continues.
Render, a platform for developers, is one of the customers Notion contacted. Its founder and CEO, Anurag Goel, made the email public, The Register reported. The email says Render’s workspace was “among the <1 percent of Notion workspaces that may have been affected.”
Fireworks, a vendor to Notion and other software companies
Fireworks AI runs openly available AI models for developers, according to BleepingComputer, a tech news site. Examples include Meta’s Llama, Mistral, and Google’s Gemma. Notion describes Fireworks as one of the most widely used AI computing platforms in the world, with tens of thousands of customers.
Notion lists Fireworks among its subprocessors, the outside companies that handle data on Notion’s behalf. The public list describes Fireworks as a provider of computing power “for serving large language models.” That means running the kind of AI that produces text.
Fireworks is also working with other customers to assess the impact of the incident, according to Bloomberg, as cited by The Register. Those customers include Cursor, an AI-assisted coding app, and Harvey, AI software for law firms.
Two intrusions at Fireworks in October
The first intrusion, detected on October 6, involved unauthorized use of Fireworks’ internal credentials, meaning its own logins. In its first security bulletin, published October 9, Fireworks said hackers had read “environment variables” in some customer accounts. Those technical settings held login codes known as API keys and access tokens. At the time, Fireworks had found no evidence of access to customers’ models, datasets, or the requests they sent to the models.
Fireworks’ November 9 update describes a second intrusion. On October 23, an outside cloud provider that hosted some of Fireworks’ research machines had a security incident. Hackers used that opening on October 24 to reach Fireworks’ development machines, where they ran an unauthorized program that affected more customer data. Fireworks says it detected the activity the same day and has seen no further successful access to its platform since October 25.
Three kinds of data are involved. The first is metadata, which describes customers’ resources on the platform: their IDs, names, and descriptions. The second is billing information: addresses, invoice and payment history, and account balances. The third is part of some customers’ datasets and unfinished model weights, the values a model learns during training.
Fireworks does not store credit card numbers. The company says it has seen no impact on its model-running service, which keeps no data by default. It notified law enforcement and is working with Unit 42, the incident response team of the cybersecurity company Palo Alto Networks. While the investigation continues, customers can no longer upload or download their datasets on their own.
Fireworks points to a criminal group
Fireworks says the evidence points to a financially motivated criminal group. The group aims to resell unauthorized access to language models, a practice known as “LLMjacking.” LLM is short for large language model. On November 2, two Google security teams, Google Threat Intelligence Group and Mandiant, published an analysis of the practice.
In some individual incidents, the Google teams saw fraudulent charges of more than $100,000, about 89,000 euros, in a single day. At some organizations, the total reached $1 million, about 890,000 euros, before access was cut off. Euro amounts use the European Central Bank rate of November 10, 2026.
“From what we see attackers are not after weights,” said Lin Qiao, Fireworks’ co-founder and CEO, as quoted by The Register. “Most downloads were partial and stopped,” she added.
Gaps in both companies’ accounts
Notion has not said how many chats are involved or what period they cover. Its advisory refers only to “the timeframe of the incident.” The “unattributable” label applies to “the vast majority” of affected workspaces. Notion does not say what sets the others apart.
Fireworks has not said how many customers are affected, The Register noted. Neither company says whether Notion’s chats were accessed during the first intrusion or the second. Fireworks’ November 9 update also revises its first bulletin, which had found no access to customer datasets.
What it means
The incident reveals a chain of subcontractors that few users know about. An AI feature built into a work app can rely on several vendors, which in turn rely on hosting providers. In this case, the leak came from a Notion vendor that was breached twice in October, once through an outside cloud provider. In mid-October, the hack of OpenCode, a coding assistant, had already shown that an AI tool could expose its users’ API keys.
The affected chats were stored at the vendor so they could be analyzed. How long an AI vendor keeps data is a separate question from training models on customer data. Notion says it does not do that by default. Notion’s page on Notion AI security also says AI providers keep data for 30 days or less on the Free, Plus, and Business plans.
Because Insights is limited to the Business and Enterprise plans, the affected workspaces are probably mostly business workspaces. Notion has not said so. The risk lies in what the chats say: a chat with no author’s name can still mention a client, a contract, or a password. In late October, a case involving Panasonic, the Japanese electronics group, showed what employees can feed into an AI tool.
In Europe, a personal data breach that puts people at risk must be reported by the data controller. That is the organization that decides how the data is used. The data protection authority, the CNIL in France, must be notified within 72 hours of discovering the breach, where possible. Notion has not said whether any European authority was informed.
Fireworks and Notion both say more updates are coming. It is not yet clear whether Cursor and Harvey will publish their own notices. Notion says it will “raise the standard” for how it protects data, but it has not yet said how. It has not given a date for bringing Insights back.
Sources
- Fireworks AI incident, Notion, November 10, 2026
- Update on October 2026 security incident, Fireworks AI, November 9, 2026
- Fireworks October 2026 security incident, Fireworks AI, October 9, 2026
- Subprocessors, Notion Trust Center, accessed November 11, 2026
- Fireworks AI gets burned twice as customer data exposure widens, The Register, November 10, 2026
- Fireworks AI discloses new breach after cloud provider hack, BleepingComputer, November 10, 2026
- The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources, Google Threat Intelligence Group and Mandiant, November 2, 2026
- Notifier une violation de données personnelles, CNIL (French data protection authority), accessed November 11, 2026
Header image: MACCUS chart, data from Fireworks AI (bulletins of October 9 and November 9, 2026) and Notion (advisory of November 9 and 10, 2026)
