As noted by Bleeping Computer, the digital workspace platform Notion recently disclosed that a security breach at its AI infrastructure provider, Fireworks AI, resulted in the exposure of Notion AI chat transcripts within a limited number of workspaces.
The incident originated from a breach at Fireworks AI, which allowed unauthorized access to its development environment via a third-party cloud provider on Oct. 23. This compromise affected resource metadata, billing information and datasets. Although Fireworks AI initially indicated that only synthetic test data was exposed, a subsequent investigation on Nov. 8 confirmed that actual customer data, including Notion AI chat transcripts used for the Insights feature, had been accessed. Notion responded by terminating traffic to the vendor, deleting all data from the provider's systems and halting active training runs. The company reported that less than 1% of its users were impacted by the breach. Most of the exposed transcripts were unattributable, meaning they lacked identifying information regarding the authors or the specific workspaces. Notion has since disabled the affected Insights dataset and advised impacted users to rotate credentials that may have been shared within the exposed chats. This event highlights the significant security risks associated with third-party AI vendors and the importance of strict data retention policies in cloud-based collaborative environments.
Source: Bleeping Computer
