Notion Customer Data Compromised in Fireworks AI Hack
Notion AI chat transcripts accessed in Fireworks AI hack affecting less than 1% of workspaces.
Notion is notifying customers about a data breach involving Fireworks AI, a platform for AI models. Attackers gained unauthorized access to Notion AI chat transcripts used for the Insights feature. Fewer than 1% of Notion workspaces were affected, and most transcripts were unattributable. Notion advises affected customers to treat the data as exposed and rotate any compromised credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Notion?
Get an email when a new story names Notion, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNotion's customer data was compromised not through a direct attack on Notion itself, but through a breach of Fireworks AI, a third-party vendor handling AI chat transcripts for the Insights feature. This is a classic supply chain security failure: sensitive customer data was processed and stored by an external platform that became the attack surface. The incident highlights the risk of extending trust implicitly to vendors who handle personal or sensitive data on your behalf. Even when a company's own security posture is strong, a weaker link in the vendor chain can expose customer data at scale. Organizations must treat third-party data processors as extensions of their own security perimeter and hold them to equivalent standards.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.