Fireworks AI says its October breach reached customer datasets and model weights

Fireworks AI has widened its account of the security incident it first disclosed in October (Fireworks bulletin). Its 9 October bulletin said only secrets stored at Fireworks, such as those used in evaluation jobs, were known to have been accessed. The 9 November update says investigators have since found impact to account and billing information, and for a limited set of accounts to secrets, datasets and incomplete models.

What Fireworks says was accessed

• Resource metadata: identifiers, display names, descriptions and creation times.
• Billing data: billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks does not store card numbers, and says they were not affected.
• Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets.

Fireworks is notifying affected customers directly and has not said how many there are.

A second way in

The update describes a separate route. A third-party cloud provider that hosted Fireworks research and development machines had its own security incident on 23 October, and on 24 October the attacker used it to reach Fireworks development machines and run an unauthorised workload that caused more customer data impact. Fireworks says it detected that the same day and has seen no further successful access to its customer platform since 25 October. It does not name the provider.

Fireworks says the evidence links the activity to a financially motivated group that sells stolen LLM access to illicit routing gateways, the “LLMjacking” trade that Symantec and Wiz have both tracked. Fireworks was the first of the nine platforms in Wiz’s “Black October” count.

What changed for customers

• Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are switched off while the investigation continues.
• Fireworks says it has found no impact to Inference, the Training SDK or Nexus, which keep no data by default, but adds that its findings are only as of now.
• Credentials and service accounts were revoked and replaced, affected systems isolated, and Palo Alto Networks Unit 42 is helping with forensics. Law enforcement has been told.

Why this matters

The first bulletin pointed customers at rotating secrets; this one means anything you uploaded for training or batch jobs may be in scope too. If you use Fireworks, check for a direct notice, rotate every key or token you ever stored in its evaluation or job settings, and list which datasets and fine-tunes you kept there. If those include customer or licensed data, involve your own security and legal teams now rather than waiting for a final report.