HACKERS STOLE CUSTOMER DATA AND HALF-FINISHED AI MODELS FROM FIREWORKS

Fireworks AI said November 9 that an October intrusion reached far more than it first reported: attackers accessed customer billing addresses, payment histories and credit usage, and for some accounts datasets and portions of unfinished AI models. When Fireworks first disclosed the breach on October 9, it said no customer models, datasets or training data had been touched.

The intrusion began October 6 with misuse of internal credentials; a second route came October 23-24 through a breached third-party cloud provider hosting Fireworks' research machines. Fireworks links the activity to a financially motivated group behind LLMjacking — reselling stolen AI access — has brought in Palo Alto Networks' Unit 42, notified law enforcement, and disabled dataset uploads and downloads for some products. Payment card numbers were not affected; Fireworks does not store them.