Fireworks says October breach reached customer datasets and incomplete model weights

Fireworks AI said an October security incident affected customer account and billing information and, for a limited set of accounts, involved unauthorized access to secrets, datasets and incomplete model weights.

Fireworks has disabled self-service dataset uploads and downloads used for Batch Inference and dataset-based training while the investigation continues. The AI infrastructure provider did not disclose how many customers were affected or quantify the material accessed.

The November 9 update expands the scope of Fireworks’ October 9 bulletin, which said unauthorized access to internal credentials had exposed environment variables containing secrets for evaluation jobs in a limited number of customer accounts. The affected internal application also provided access to resource metadata and billing information, Fireworks now says, including billing and shipping addresses, invoice and payment history, account balances and credit usage.

Fireworks said it does not store payment card numbers and that card numbers were not affected. For certain customers, it said a subset of incomplete model weights and datasets was accessed. The company did not identify those customers or disclose the volume of data involved.

The update also detailed a later intrusion through an unnamed third-party cloud provider that hosted Fireworks research and development machines. Fireworks said the provider experienced a security incident on October 23. An unauthorized party then reached Fireworks development machines and ran an unauthorized workload on October 24, causing additional customer-data impact.

Fireworks said it had found no evidence of successful unauthorized access by the threat actor on its customer-facing platform after October 25. It also said it had detected no impact to Inference, Training SDK or Nexus, services it described as using zero data retention by default. Those remain the company’s findings to date; the investigation is ongoing and may uncover more information.

According to the update, Training SDK remains available without training data stored at rest. Fireworks said its Lab training service operates in an isolated environment with additional network and storage protections.

Fireworks said it notified law enforcement and engaged Palo Alto Networks Unit 42. Its response included replacing credentials and service accounts, restricting network pathways, isolating affected systems, tightening data-access controls, and increasing logging and monitoring.

The company assessed that the activity was linked to a financially motivated cybercriminal group seeking to sell unauthorized access to large language models through illicit routing gateways, a practice it called “LLMJacking.” It did not publicly identify the group or the third-party cloud provider.