Fireworks admits hackers reached customer datasets and partial model weights

Fireworks AI, the inference provider, said in an updated security bulletin that the intruders behind its recent incident also reached datasets, incomplete model weights and billing records for some customers. Forbes reported the disclosure; the company’s own update carries the details.

What Fireworks says was accessed

The first bulletin described unauthorized use of internal credentials and access to environment variables in evaluation jobs for a limited number of accounts. At that point Fireworks said it had found no sign that customer models or datasets were touched.

The update changes that. Fireworks now says a subset of incomplete model weights and datasets was accessed for certain customers. It also lists billing and shipping addresses, invoice and payment history, account balance and credit usage, plus resource metadata such as names and descriptions. Secrets were affected for a limited set of accounts.

Fireworks states that “Payment card numbers are not stored by Fireworks and were not impacted.” It says its Inference, Training SDK and Nexus services show no impact. The bulletin does not give the number of affected customers, and says those affected are being notified directly.

A second route in through a cloud provider

According to Fireworks, law enforcement was notified and Palo Alto Networks Unit 42 is doing forensic analysis. The company says a third-party cloud provider hosting its research machines had its own security incident, which the unauthorized party then used to reach Fireworks development machines and run a workload that affected more customer data. Fireworks says it detected this the same day.

On attribution, Fireworks says the evidence points to a financially motivated group that resells access to language models. It cites a Google Threat Intelligence Group and Mandiant post on “LLMJacking”. These findings are Fireworks’ own and are not independently verified.

The company has disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training during the investigation, and lists credential revocation and tighter network and storage controls among its fixes.

A trust problem for a company selling private model tuning

Bloomberg headlined its report as the Nvidia-backed company notifying customers of its second hack in weeks. Fireworks sells itself as the place where companies run and fine-tune open models on their own data, so an incident touching datasets and partial weights hits the core of that pitch. The bulletin’s stress on zero data retention for inference and training draws a line between products that held no data and the evaluation, dataset and billing systems that did.

Forbes said two customers told it they had already substantially moved their business off Fireworks’ systems. That is the outlet’s claim, and the public summary does not name them.

What customers should check now

Teams that stored API keys or tokens as secrets in evaluation jobs should treat them as exposed. The first bulletin warned that deleting a secret from the platform does not invalidate the credential itself, which must be revoked with whoever issued it. Customers who used dataset-based training or Batch Inference should wait for Fireworks’ direct notice to learn whether their files were among those accessed.

Still open: how many customers are affected, which datasets and weights were taken, which cloud provider was involved, and whether more will be found. Fireworks says it will keep monitoring and publish further updates as appropriate.