"The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as 'LLMJacking'," Fireworks said at the time.
Fireworks' disclosure and the initial incident
Fireworks, an AI infrastructure startup that offers a high-performance inference platform for developers running open-source models such as Mistral, Meta's Llama, or Google's Gemma, disclosed a series of security incidents beginning in early October. The company notified law enforcement and customers after attackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. Fireworks characterized the likely adversary as a financially motivated cybercriminal group seeking to profit by selling stolen tokens for LLM access.
How the cloud-provider compromise led to a second breach
After Fireworks revoked compromised internal credentials and affected API keys, the company discovered a second incident on October 23. According to Fireworks, a third-party cloud provider hosting Fireworks' research-and-development machines experienced a security incident on October 23. On October 24 the unauthorized third party used that access to reach Fireworks development machines and run an unauthorized workload that produced additional customer data impact.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleData accessed and what attackers could not reach
Fireworks reported that the attackers accessed resource metadata — examples given include Fireworks resource identifiers, display names, descriptions, and creation time — as well as billing information such as billing and shipping addresses, invoice and payment history, account balance, and credit usage. The company also said incomplete model weights and datasets for some customers were accessed. Fireworks emphasized that attackers could not access customer payment card numbers because Fireworks does not store them.
Incident response steps and ongoing investigation
Fireworks said it detected the unauthorized activity on the same day it occurred and followed incident response processes to take immediate remediation measures and close known critical vulnerabilities. Actions the company listed include revoking and replacing credentials and service accounts, restricting unauthorized network pathways, isolating affected systems, and tightening access to data storage and analytics systems to block public or unauthorized access. As of October 25, Fireworks reported it had not detected further evidence of successful unauthorized access to the Fireworks platform that customers use.
Fireworks is working with Palo Alto Networks' Unit 42 incident response division to secure systems against future attacks and to further investigate the full scope and impact.
Context: LLMjacking and the market value of stolen tokens
Fireworks tied the earlier credential theft to a criminal market for LLM access, using the term "LLMJacking" to describe illicit routing of stolen tokens. One week prior to Fireworks' latest disclosure, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant reported that large language model hijacking attacks (also known as LLMjacking) can be financially lucrative, with losses described as "as high as $1 million due to fraudulent calls using stolen API keys."
What this means for customers, security teams, and threat actors
- Customers and procurement leaders: Organizations that used Fireworks' platform should treat exposed resource metadata, billing records, and any incomplete model artifacts as properties requiring review; Fireworks has already informed customers and law enforcement and has replaced affected API keys and credentials.
- Technologists and security teams: The incident underscores the risk surface introduced by third-party cloud providers hosting development environments — teams will likely prioritize rotating credentials, isolating R&D machines, restricting network pathways, and auditing storage and analytics access, consistent with the measures Fireworks reported taking.
- Adversaries and criminal marketplaces: Fireworks' statement and the GTIG/Mandiant reporting together signal that stolen tokens and API keys remain a monetizable commodity, with attackers exploiting cloud-hosted R&D access to harvest material they can sell into illicit LLM routing services.
Fireworks' public account establishes a clear sequence: an initial compromise of environment variables and secrets in early October, revocations and remediation, a separate cloud-provider incident on October 23 that enabled access to development machines on October 24, detection and containment the same day, and no further detected customer-platform access as of October 25. The company has enlisted Unit 42 to continue the forensic work. Key open questions — the full extent of any exfiltrated model weights and datasets, and what remediation or disclosures the third-party cloud provider will make — remain tied to that continuing investigation.
