Hackers Breach Fireworks AI Through Third-Party Cloud Provider to Steal Customer Data

What happened?

Fireworks AI has disclosed a wider security breach involving customer account details, billing records, datasets, and incomplete model weights. In a November 9, 2026 update, the company said attackers reached its development machines through a third-party cloud provider, expanding the impact beyond the exposed credentials reported in October. The findings change the picture presented in its first disclosure. Fireworks initially reported unauthorized access to secrets used in evaluation jobs across a limited number of accounts.

Key details

• Fireworks AI disclosed a broader breach exposing customer account details, billing records, datasets, and incomplete model weights.
• Attackers accessed development machines via a third-party cloud provider incident starting October 23, 2026.
• Billing data exposed includes addresses, invoices, payment history, balances, and credit usage; payment card numbers were not stored.
• Evidence points to a financially motivated group seeking to sell unauthorized LLM access through illicit routing gateways known as LLMJacking.
• Fireworks engaged Palo Alto Networks Unit 42 for forensic support and notified law enforcement.
• Self-service dataset uploads and downloads for Batch Inference and dataset-based training were disabled during the investigation.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.