Notion Confirms Leak of User Correspondence Due to Fireworks AI Hack: What Data Is at Risk

Notion has confirmed a leak of user correspondence involving its built-in artificial intelligence following a cyberattack on the third-party provider Fireworks AI. The incident affected less than 1% of workspaces. According to preliminary information, users’ saved notes were not compromised.

The attackers compromised the infrastructure of the third-party provider Fireworks AI, which powered the platform’s artificial intelligence.

Notion’s own systems were not compromised, but the attack on the third-party contractor led to the exposure of user correspondence containing their queries and the AI’s responses.

Timeline of the incident:

• On the evening of November 2, 2026, Fireworks representatives notified their partners of the unauthorized access. Initially, the developers believed that the incident affected only synthetic test data.
• On the morning of November 3, Notion promptly severed its connection to the service, deleted all files stored in the Fireworks environment, and completely halted interaction between the systems.
• On November 6, the provider warned of a possible leak of real customer records.
• On November 8, the list of compromised data was finally confirmed.

Analysis showed that the attackers obtained Notion AI chat transcripts related to the Insights analytics feature. The company began notifying affected customers on November 9.

Most of the exposed records have no direct link to specific accounts. In particular, they do not contain authors’ names, workspace IDs, or responses from system tools.

At the same time, the query texts retained everything that users typed themselves. Therefore, if people copied confidential passwords or production API keys into the chats, that data could have ended up in the public domain.

Notion used the Fireworks infrastructure for two purposes: to classify queries in the Insights section, which shows companies statistics on AI usage, and to generate responses using open models.

After the incident was detected, Notion suspended the Insights feature and completely stopped using models via Fireworks’ servers.

Fireworks described the incident as an unauthorized use of internal credentials, which granted access to environment variables for a limited number of client accounts.

Experts warn that compromised access keys to AI services can be used in attacks such as LLMjacking. In particular, hackers can resell the obtained resources or automatically hijack other users’ sessions.

The Notion team urges affected users to verify their data according to the instructions in the emails they received. It is also necessary to immediately change all login credentials that may have been used in AI chatbots during the incident.

It is important to note that simply deleting records from the database does not invalidate the tokens. Therefore, access keys must be updated directly within the services that issued them.

This is stated in an official announcement from Notion.

As a reminder, the U.S. FBI previously stated that the North Korean hacker group TraderTraitor was behind a large-scale cyberattack on the Binance cryptocurrency exchange, during which assets worth over $6 billion were stolen. 

The U.S. Federal Reserve and the Office of the Comptroller of the Currency reached out to banks following the cyberattack on the Binance cryptocurrency exchange to determine whether their systems had any vulnerabilities.