[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmYzit-1dgKfjvXZuXE90t1tl3hyaaXV4t6doWLu49eg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"4d72beac-5c7d-4405-8569-0a27b84a02b6","third-party-ai-provider-breach-exposes-notion-customer-chat-transcripts","b36ea277-6391-4872-b7c2-be0b9a783a3e","Third-Party AI Provider Breach Exposes Notion Customer Chat Transcripts","Notion's exposure of AI chat transcripts stemmed not from a flaw in its own systems, but from a breach at Fireworks AI, a third-party provider powering the Notion AI 'Insights' feature. This is a classic supply chain security failure: Notion's customers trusted Notion, but their data was at risk through a vendor Notion trusted. The incident highlights that sensitive customer data — including potentially credentials pasted into AI chats — can be exposed even when your own infrastructure is secure. Organizations must treat third-party data processors as an extension of their own attack surface and apply commensurate due diligence and contractual controls.","**Immediate actions:**\n- Notify all affected customers promptly and advise them to rotate any credentials or sensitive information shared via AI chat features.\n- Audit which third-party vendors currently store or process customer data and assess the scope of data exposed by each.\n\n**Long-term improvements:**\n- Establish a formal third-party risk management program requiring vendors to meet defined security standards before handling customer data.\n- Minimize data shared with AI sub-processors by applying data minimization principles — avoid storing full chat transcripts unless operationally essential.\n- Include mandatory breach notification SLAs and security assessment rights in all vendor contracts.\n\n**Detection measures:**\n- Implement continuous monitoring of third-party vendor security posture using supply chain risk intelligence tools.\n- Require vendors to provide timely, structured incident reports so downstream notifications to customers can be issued without delay.",[12,13,14,15,16],"NIS2 Article 21(2)(d)","NIST SP 800-53 SA-9: External System Services","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality","GDPR Article 28",{"GDPR Article 28":18,"NIS2 Article 21(2)(d)":19,"NIST SP 800-53 SA-9: External System Services":20,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":21,"NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality":22},"Article 28 requires that data controllers use only processors providing sufficient guarantees and bind them via contract to process data only as instructed and securely — obligations directly applicable to Notion's relationship with Fireworks AI as a sub-processor of EU customer data.","This point explicitly requires organizations to implement security measures addressing supply chain risks, including the security practices of direct suppliers and service providers like Fireworks AI.","SA-9 requires organizations to define and enforce security requirements for external providers and monitor their compliance — controls that would have set expectations for Fireworks AI's data protection obligations.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have included security vetting and contractual obligations for Fireworks AI.","This category asks organizations to identify and prioritize suppliers based on the criticality of the data they handle, which would have flagged Fireworks AI as a high-priority vendor given its access to customer AI transcripts.","published","2026-11-10T17:20:22.309114+00:00","2026-11-10T17:20:22.297+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fnotion-confirms-data-breach\u002F","notion-confirms-ai-chat-transcripts-exposed-in-fireworks-ai-breach-affecting-cus-365e5f","Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach, Affecting Customer Workspaces",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":50,"name":51,"problem":52},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]