Fireworks AI 遭网络攻击 波及 Notion 约 1% 用户
Fireworks AI 确认其云服务商遭攻击者入侵，导致开发系统被渗透，部分客户的账单信息与数据集被窃取。在线文档工具 Notion 证实约 1% 的客户数据受影响，已于 11 月 3 日切断与 Fireworks 的系统连接并删除相关数据。这是 Fireworks 两个月内发生的第二起安全事件。
报道正文
A cyberattack at Fireworks AI has exposed some of its customers’ data, the company has confirmed. Fireworks AI, a platform that developers use to access and use open AI models, said an attacker breached its cloud provider to gain access to a Fireworks development system, which allowed access to some of its customers’ data.
The company said in its latest security advisory that the cybercriminals took Fireworks’ customers’ billing information and some datasets. Fireworks touts tens of thousands of customers worldwide using its platform, including legal tech company Harvey and AI company Cursor.
At least one confirmed affected customer is online document editor and notetaker Notion, which said in a disclosure that the breach affected around 1% of its own customers.
Notion said that Fireworks alerted the company to a security incident and later confirmed that the hackers had stolen some Notion customer data. On November 3, Notion said it disconnected its systems from Fireworks, deleted the data stored in its systems, and stopped all connectivity between the two.
Notion confirmed this week that the hackers took chat transcripts of its Notion AI customers who used the “Insights” feature. The company said that the transcripts include “any input to or output from the model that was written to the chat is included in that chat transcript,” but added that much of the data was unattributable and could not be determined from which customer it was obtained.
The breach at Fireworks AI shows how tech companies are reliant on other tech providers for their own offerings, and how cyberattacks can, as a result, spill over into other customers.
Fireworks said that it believes the hackers are financially motivated and that their goals are focused on selling tokens from breaching access to large language models, or LLMs. These schemes rely on selling to unauthorized third parties, who can burn through AI model usage without using their own resources.
This is the second breach affecting Fireworks in as many months, following a security incident in October.