[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frjVqtM_LqImY4I22b_4jek_X2GX5KD-YGvrpfX4ULuE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"88a3f855-2257-4435-bfe4-76c957b339bf","dual-breaches-at-fireworks-ai-expose-supply-chain-and-access-control-gaps","4dbff3ed-0355-475c-a3f8-779984e6bb8b","Dual Breaches at Fireworks AI Expose Supply Chain and Access Control Gaps","Fireworks AI suffered two separate data breaches in October, with the second stemming from an attack on a third-party cloud provider that cascaded into unauthorized access to Fireworks' own development machines and customer data. This illustrates a critical supply chain risk: an organization's security posture is only as strong as its least-secure vendor or partner. When third-party access is not tightly scoped, monitored, or segmented, attackers can pivot from a compromised supplier directly into a customer's core infrastructure. The theft of billing and AI-specific data amplifies the harm, as customers face both financial and intellectual property exposure.","**Immediate actions:**\n- Audit and revoke any unnecessary third-party access credentials or API tokens connected to your cloud environments.\n- Rotate all credentials and secrets that may have been accessible from compromised development machines.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all third-party cloud provider integrations, limiting what systems and data each vendor can reach.\n- Implement network segmentation so that a breach of a development environment cannot propagate to production or customer data systems.\n- Establish a formal third-party risk management program with contractual security requirements and regular vendor security assessments.\n\n**Detection measures:**\n- Deploy continuous monitoring and alerting for anomalous access patterns from third-party accounts or service principals.\n- Require third-party vendors to notify you of any security incident affecting shared infrastructure within a defined SLA window.",[12,13,14,15,16],"NIS2 Article 21(2)(d)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","CIS Control 15: Service Provider Management (v8)","NIST SP 800-53 AC-3: Access Enforcement","NIST CSF 2.0 GV.SC-04: Suppliers and third-party partners are routinely assessed",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 AC-3: Access Enforcement":19,"CIS Control 15: Service Provider Management (v8)":20,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":21,"NIST CSF 2.0 GV.SC-04: Suppliers and third-party partners are routinely assessed":22},"This point specifically requires organizations to manage security risks arising from supplier and third-party relationships, which is exactly the vector used in the second Fireworks breach.","This control requires that access to systems and data be enforced based on least-privilege principles, which would have limited the lateral movement from the compromised third-party cloud provider into Fireworks' development machines.","This control requires organizations to establish policies and procedures to evaluate, monitor, and limit the access and security posture of third-party service providers, directly addressing the third-party cloud pivot in this incident.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have governed the security obligations of the third-party cloud provider involved.","This category explicitly calls for ongoing assessment of supplier and partner security practices, which could have identified the third-party cloud provider's weaknesses before they were exploited.","published","2026-11-10T17:22:22.923957+00:00","2026-11-10T17:22:22.909+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Ftherecord.media\u002Fai-company-fireworks-says-hackers-stole-data-in-oct-attacks","ai-company-fireworks-says-hackers-stole-data-billing-info-during-october-breache-266c19","AI company Fireworks says hackers stole data, billing info during October breaches",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":50,"name":51,"problem":52},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]