Fireworks expands breach disclosure to customer datasets and model weights
US AI infrastructure provider Fireworks has widened its October incident disclosure, reporting impacts to account and billing information and, for some customers, datasets and incomplete model weights. Its November 9 update describes additional customer-data exposure and direct notifications. The company says it has restricted dataset transfers while the investigation continues and is sending affected customers details specific to their accounts.
Artificial Intelligence··Evening
More customer-data categories are affected
US AI infrastructure provider Fireworks AI expanded its October security-incident disclosure on November 9. The company says account and billing information was affected, along with datasets and incomplete model weights belonging to some customers. Initial disclosure had focused on stored secrets used in evaluation jobs. Fireworks is sending affected customers account-specific information and response recommendations as its investigation continues.[1], [2]
The update describes additional October exposure
Fireworks says a separate incident at a cloud provider hosting its research and development systems was followed by further customer-data impact on October 24. It says it detected that activity the same day and addressed known critical vulnerabilities. The company reports no further evidence of successful attacker access to the customer platform since October 25. That statement reflects the findings of an investigation that remains open.[1]
Dataset transfers are restricted during the investigation
The company has disabled self-service dataset uploads and downloads used for batch inference and dataset-based training. It says payment-card numbers were unaffected because it does not store them. Fireworks has notified law enforcement and engaged Unit 42, Palo Alto Networks’ forensic investigation team. Affected data categories described in the update include resource metadata, addresses, payment histories, balances and credit usage, alongside the limited customer datasets and incomplete weights.[1]
