Fireworks AI Says Attackers Accessed Development Systems via Cloud Provider Breach
Summary
Fireworks AI says attackers reached its development machines through a third-party cloud provider incident and accessed customer metadata, billing information, and incomplete model weights and datasets. The company says it detected the activity and took remediation措施.
Key points
- Fireworks said a security incident at a third-party cloud provider on October 23 enabled an unauthorized party to reach its development machines the following day and run an unauthorized workload.
- The company reported access to resource metadata, billing information, and incomplete model weights and datasets for some customers.
- Fireworks said customer payment card numbers were not accessed because the company does not store them.
- The company said it detected the activity on October 24, revoked and replaced credentials and service accounts, isolated affected systems, and restricted unauthorized network pathways.
- As of October 25, Fireworks said it had found no further evidence of successful unauthorized access to the customer-facing platform; it is investigating the incident's full scope with Palo Alto Networks' Unit 42.
Article Details
- Victim Organization
- Fireworks AI
- Incident Type
- Unauthorized access to Fireworks development machines through a security incident at a third-party cloud provider, followed by an unauthorized workload that affected customer data.
- Incident Date
- 2026-10-23
- Data Types Exposed
- Resource metadata, including resource identifiers, display names, descriptions, and creation times
- Billing information, including billing and shipping addresses, invoice and payment history, account balance, and credit usage
- Incomplete model weights and datasets for some customers
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Attackers accessed Fireworks development machines and ran an unauthorized workload that led to additional customer data impact. Fireworks said it detected the activity on October 24, isolated affected systems, revoked and replaced credentials and service accounts, restricted unauthorized network pathways, tightened access to data storage and analytics systems, and closed known critical vulnerabilities. As of October 25, it had detected no further evidence of successful unauthorized access to the customer platform.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed