Fireworks discloses wider breach impact, including customer datasets and unfinished models

Fireworks’ October security incident reached beyond stored credentials: the AI infrastructure provider said on November 9, 2026, that account and billing information was affected too. For a limited set of accounts, the exposure also included secrets, datasets and incomplete model weights. Its security update describes another intrusion through a third-party cloud provider.

Fireworks helps businesses build and run AI models. The new disclosure widens the known scope of an incident it first addressed in an October 9 bulletin. At that point, the company said, only stored secrets—such as those used in evaluation jobs—were known to have been accessed. Its subsequent investigation uncovered impacts to additional categories of customer information.

The newly described route began outside Fireworks. A third-party cloud provider hosting its research and development machines experienced a security incident on October 23. The next day, an unauthorized party used that opening to reach Fireworks development machines and run an unauthorized workload, causing additional customer-data impact. Fireworks said it detected the activity on October 24 and immediately took remediation measures, including closing known critical vulnerabilities.

Fireworks said evidence points to links with a financially motivated cybercriminal group seeking to sell unauthorized access to large language models through illicit routing gateways. The company calls this activity LLMJacking: selling access obtained without the model account owner’s permission. That is its assessment of the attackers’ motive, rather than a publicly identified attribution to a named group.

The affected internal application provided access to several kinds of information. Fireworks listed resource metadata alongside billing records and, for certain customers, portions of datasets and incomplete model weights—the numerical values that make up a model.

• Resource metadata included identifiers, display names, descriptions and creation times.
• Billing information included billing and shipping addresses, invoice and payment histories, account balances and credit usage. Payment card numbers were not affected; Fireworks says it does not store them.
• For certain customers, a subset of incomplete model weights and datasets was accessed. Fireworks is notifying affected customers with details and recommended response actions.

Fireworks said it has not detected impact to Inference, Training SDK or Nexus, which it describes as zero data retention by default. It also said that, as of October 25, it had not detected further successful unauthorized access by the attacker on its customer platform. These are findings from an ongoing investigation, which the company cautioned may uncover additional information.

The response has changed what customers can do. Fireworks disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates. Training SDK remains available without training data stored at rest, the company said. Training through Fireworks Lab operates in an isolated environment with additional network and storage protection.

Fireworks notified law enforcement and brought in Palo Alto Networks’ Unit 42 for forensic analysis and security hardening. Its measures include replacing credentials and service accounts, removing unnecessary elevated permissions, restricting network pathways and isolating affected systems. It also tightened access to storage and analytics systems and strengthened logging and monitoring.

Some customers have already acted. Two customers told Forbes they had substantially moved their business off Fireworks’ systems. One described a series of “very bad hacks” and criticized the company’s communication about the attacks. Two other customers interviewed by Forbes said they were unaware of any Fireworks hacks. Those accounts capture different customer experiences, not a measure of how broadly the breach affected Fireworks’ customer base.