"Unattributable means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.” — Notion.
What happened: a brief timeline
Notion disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts from a small number of workspaces. Fireworks first acknowledged an attacker accessed its development environment via a third‑party cloud provider on October 23, compromising resource metadata, billing information, model weights, and datasets for some customers.
Fireworks had earlier experienced a separate incident in early October in which hackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. On November 2, Fireworks alerted Notion to an exposed dataset that the vendor said contained only synthetic test data. Notion cut off traffic to Fireworks, deleted all Notion data from the vendor’s systems, and halted training runs by November 3. On November 8, Fireworks confirmed customer data had been accessed, including that of Notion users.
Which data were exposed: Insights transcripts, not tool outputs
Notion says the exposed material came from the Insights dataset — the portion of Notion AI that analyzes stored conversations so workspace administrators can see how teams use AI. According to Notion’s update, the dataset Fireworks provided on November 8 included Notion AI chat transcripts used for Insights.
For the vast majority of impacted workspaces those transcripts were “unattributable,” Notion wrote: they lacked labels tying chats to specific authors or workspaces, and they “did not contain tool call results.” Notion also notes that Fireworks had contractually committed to zero data retention for Notion data.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleNotion's response and guidance for affected users
After receiving Fireworks’s alert on November 2, Notion took several steps by November 3: it cut off traffic to Fireworks, deleted all Notion data from the vendor’s systems, and halted ongoing training runs. Notion disabled the Insights dataset while it investigated the incident.
Notion says less than 1% of its users are impacted. The company asks potentially affected workspace owners to review the data via the Security incident review option in Notion’s desktop web interface and to share a link that lets members download their own transcripts. Notion advises affected users to rotate any passwords, API keys, or other credentials that were entered into affected chats. If neither a user nor their workspace owner has received a notice, Notion says no action is needed for now and those users are most likely not part of the impacted subset.
Fireworks AI’s role: model access and dataset handling
Fireworks AI enables Notion to run some of the open‑weight models available through Notion AI and to analyze stored conversations for the Insights feature. The incidents at Fireworks included access to its development environment and to sensitive configuration material: resource metadata, billing information, model weights, and datasets. Earlier in October attackers also accessed environment variables with stored API keys and tokens for a limited number of accounts.
Fireworks initially informed Notion about an exposed dataset on November 2 that the vendor characterized as synthetic test data; it later confirmed on November 8 that customer data had been accessed. In response, Notion removed its data from Fireworks and disabled the Insights dataset.
What this means for security teams, workspace owners, and procurement
- Technologists and security teams: The incident underscores the exposure that can follow when third‑party providers hold model weights, datasets, or secrets. Teams will focus on verifying deletion, auditing third‑party access controls, and rotating credentials that may have been entered into affected chats, as Notion recommends.
- Workspace owners and end users: Notion has provided a route to review and download transcripts via Security incident review. Owners of potentially affected workspaces must check those notifications and follow Notion’s guidance to rotate any credentials entered into chats.
- Procurement and vendor‑risk teams: Fireworks had contractually committed to zero data retention for Notion data; this incident spotlights the practical challenges of enforcing contractual retention promises and the need to validate vendor controls and incident notification timelines.
The sequence of events — Fireworks’s October 23 access to its development environment, Notion’s November 2 alert and immediate containment on November 3, and Fireworks’s November 8 confirmation that customer data was accessed — leaves an unsettled but concrete record. Notion has disabled Insights and says fewer than 1% of users were affected; it has directed workspace owners to review and distribute transcripts and to rotate credentials where needed. Whether the full scope of affected datasets and the effectiveness of contractual zero‑retention commitments will be resolved publicly remains a central, practical question for the companies and their customers.
