Fireworks Says Second Breach Exposed Customer Billing Data, Datasets and Partial Models

The disclosure came in an update to the security bulletin the company first posted on October 9, and it widens an incident Fireworks had first described as limited to credentials stored in evaluation jobs. At that point the company said it had found no evidence that customer models, datasets or training data had been accessed. The new update says the attackers reached a subset of incomplete model weights and datasets belonging to certain customers.

The revision matters because Fireworks' business depends on companies trusting it with proprietary data to train and serve their models. The Information reported, citing two people with knowledge of the breach, that over the past week Fireworks told some large customers, including the legal AI company Harvey, about the more serious hack. One of those people said some customers who spend millions of dollars a year with Fireworks are considering moving to other providers.

According to the bulletin, a third-party cloud provider that hosted Fireworks' R&D machines had a security incident on October 23. The next day the unauthorized party used that access to get onto Fireworks development machines and run an unauthorized workload, which Fireworks said it detected the same day. The company said it has seen no further evidence of successful unauthorized access to its customer platform since October 25.

Fireworks said it brought in law enforcement and Palo Alto Networks' Unit 42 for forensic work. It said the evidence points to a financially motivated group that sells tokens obtained through unauthorized access to large language models to illicit routing gateways, a practice known as LLMjacking. The bulletin cites a November 2 post on the technique by Google Threat Intelligence Group and Mandiant.

The exposed data includes resource metadata such as identifiers, display names, descriptions and creation times. It also includes billing information: billing and shipping addresses, invoice and payment history, account balances and credit usage. Fireworks said it does not store payment card numbers. It said it found no impact on its inference service, its Training SDK or its Nexus product, which do not retain customer data by default. The company has not said how many customers were affected. It said it is notifying them directly and will give them recommended steps.

Fireworks said it has revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, isolated affected systems, tightened access to storage and analytics systems and expanded logging and monitoring. It has also switched off self-serve dataset uploads and downloads for batch inference and dataset-based training, which changes how some customers use the platform. The Training SDK remains available.

Fireworks is one of at least nine AI developer platforms that disclosed security incidents in October, according to a count by the cloud security company Wiz. Wiz linked the wave to LLMjacking and said the ready market for model access makes stolen credentials easy to sell. Wiz also said Fireworks was among the companies reporting signs of an "agent swarm" attack.

The breach comes at a delicate moment for the company. Fireworks was founded in 2022 by former Meta and Google employees and is led by chief executive Lin Qiao. A Series D round in July, led by Atreides Management, Index Ventures and TCV, valued it at $17.5 billion, and Nvidia and Sequoia Capital are also investors. Business Insider has reported that it is in early talks to raise money at a valuation of $30 billion to $40 billion. Last week Dave Wehner, Meta's chief strategy officer and former chief financial officer, said he was leaving to become Fireworks' CFO. Fireworks lists the bulletin's status as active monitoring.