Notion AI Data Breach: Fireworks Hack Exposed AI Chats

If you've ever dumped meeting notes, client info or (please no) an API key into Notion AI, this one's for you. Notion just confirmed that a hack at one of its AI vendors, Fireworks AI, exposed Notion AI chat transcripts from a small slice of workspaces. Notion itself wasn't breached, but your chats were sitting somewhere that was. Here's the no-fluff breakdown.

TL;DR

Fireworks AI, an AI infrastructure company Notion used for some Notion AI features, says attackers broke into its systems.

The stolen data included Notion AI chat transcripts used for the Insights feature, affecting fewer than 1% of Notion workspaces.

Notion says most of those transcripts were "unattributable" (no name or workspace label), but anything you typed inside a chat is still in there.

Notion cut off Fireworks, disabled Insights, and on 11 November 2026 revoked Notion API keys it found pasted into affected chats.

Got a notice? Rotate any passwords, API keys or credentials you pasted into Notion AI. No notice? Notion says no action is needed right now.

What happened in the Notion AI data breach?

According to Notion's official Fireworks AI incident advisory, the company used Fireworks AI for two things: running classification jobs for Insights (a feature that shows workspace admins how their teams use AI) and serving open-weight models inside Notion AI.

When Fireworks got hit, a dataset tied to that Insights work was taken. Notion says: "Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable."

"Unattributable" means the chats weren't labelled with who wrote them or which workspace they came from, and they didn't include tool call results. Notion adds that "beyond what's in the chat transcript itself, there's no information tying the chat back to workspaces, users, or companies." The catch is in that first half of the sentence: if your chat itself mentioned your company, a client or a password, that text was exposed.

Notion breach timeline

2 November 2026 (evening): Fireworks tells Notion a small set of data was accessed. At first it looks like only synthetic test data.
3 November: Notion disconnects from Fireworks, deletes all its data on Fireworks' systems and stops all traffic.
6 November: Fireworks warns that customer data may have been accessed after all.
8 November: Fireworks confirms the final impacted dataset, which includes Notion AI chat transcripts.
9 November: Notion contacts affected customers.
11 November: Notion revokes exposed Notion API keys found in affected user messages.

How did Fireworks AI get breached?

This wasn't Fireworks' first rough month. The Hacker News reports that Fireworks first detected unauthorized use of internal credentials on 6 October 2026, which let an outsider grab environment variables (including API keys and tokens) from some customer accounts.

Then it got worse. Fireworks says attackers reached its development environment on 23 October through an unnamed third-party cloud provider that hosted its R&D machines, and on 24 October ran an unauthorized workload that hit more customer data. Exposed info included resource metadata, billing details (billing and shipping addresses, invoice and payment history) and a subset of incomplete model weights and datasets. Fireworks says it doesn't store payment card numbers.

Illustration used by The Hacker News for its report on the widening Fireworks AI breach

Fireworks says the evidence points to a financially motivated group trying to resell stolen access to AI models, a growing crime known as LLMjacking: hijack someone's AI account, sell the access, and leave the real owner holding the bill.

Wait, didn't Fireworks promise zero data retention?

Kind of. VentureBeat points out that Fireworks' docs say it has zero data retention by default, meaning prompts and replies only live in memory during a request. But its own policy page also says a few features, such as stored responses, batch jobs and training, do keep customer content. The breach hit that stored side. According to BleepingComputer, Notion's FAQ on the incident says Fireworks had contractually committed to zero data retention for Notion data.

Big lesson for everyone: "we don't keep your data" often has fine print, and your AI prompts can travel through vendors you've never heard of.

Am I affected? How to check

Check your inbox (and ask your workspace owner). Notion says it contacted affected customers from 9 November. If neither you nor your workspace owner got a notice, Notion hasn't identified your workspace and says no action is needed right now.
Workspace owners: open Security incident review in Notion's desktop web interface to see the impacted data, then share the link so members can download their own transcripts, as BleepingComputer reports.
Treat it as leaked. Notion itself recommends treating the affected data "as if it were exposed".

What to do right now if you were affected

Rotate every secret you pasted into Notion AI during the incident window: passwords, API keys, tokens, database URLs. Notion already revoked exposed Notion API keys, but keys for other services are on you.
Turn on 2-step verification or passkeys on any account whose password showed up in a chat.
Tell anyone whose info you shared (clients, teammates) if the chats held their personal or confidential details. Companies may also need to check their own breach-reporting rules.
Watch for phishing. Breaches are usually followed by fake "security alert" emails. Go to Notion directly instead of clicking links, the same playbook we covered in our Amadeus data breach guide.

The bigger lesson: stop pasting secrets into AI chats

This breach didn't need anyone to hack Notion. It hit a vendor behind the scenes. That's why the safest rule for ChatGPT, Claude, Gemini, Copilot or Notion AI is the same: never paste passwords, API keys, card numbers or anyone's private info into an AI chatbot. Use a password manager for secrets, redact names before asking AI to summarise sensitive docs, and if you run a team, check which AI features (like usage analytics) store chat logs and where.

FAQ

Was Notion hacked?

Notion says its own systems were not breached. The data was taken from Fireworks AI, a third-party AI infrastructure provider Notion used for some Notion AI features.

What data was exposed in the Notion AI breach?

Notion AI chat transcripts used for the Insights feature. Notion says that for the vast majority of affected workspaces the transcripts were unattributable, meaning they were not labelled with who wrote them or which workspace they came from, and they did not contain tool call results.

How many Notion users are affected?

Notion says fewer than 1% of Notion workspaces were impacted. It contacted affected customers from 9 November 2026.

How do I know if my Notion workspace was affected?

Notion says it has contacted affected customers directly. If you and your workspace owner have not received a notice, Notion has not identified your workspace as affected and says no action is needed right now.

What should affected Notion users do?

Review the exposed data through Security incident review in Notion's desktop web interface, treat it as exposed, and rotate any passwords, API keys or other credentials that were pasted into Notion AI chats during the incident window.

Is it safe to keep using Notion AI?

Notion says no other features were affected, it has disabled the Insights feature and stopped serving open-weight models through Fireworks. As a general rule, never paste passwords, API keys or other secrets into any AI chatbot.

Main source: Notion, Fireworks AI incident security advisory (updated 10 and 11 November 2026). Also referenced: BleepingComputer (11 November 2026), The Hacker News (10 November 2026) and VentureBeat.

Image credits

Featured graphic: Factash original.
Fireworks AI breach illustration: The Hacker News.

Notion AI Data Breach: Fireworks AI Hack Exposed Notion AI Chat Transcripts (What to Do Now)