Hackers Breach Fireworks AI Through Third-Party Cloud Provider to Steal Customer Data

Fireworks AI has disclosed a wider security breach in which attackers reached its development machines through a third-party cloud provider and accessed customer account details, billing records, datasets, and incomplete model weights. The company said the incident began on October 23 and expanded beyond exposed credentials first reported in October. Fireworks has notified affected customers and law enforcement while its investigation continues.

How the breach unfolded

According to Fireworks, a cloud provider hosting its research and development machines experienced a security incident on October 23. On October 24, an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload, leading to further customer data exposure. Fireworks said it detected the activity that day, took immediate response measures, and closed known critical vulnerabilities. It has not named the cloud provider or disclosed specific vulnerabilities. The company reported no further detected successful access by the attacker on its customer platform as of October 25.

Earlier credential incident

The updated disclosure builds on an earlier incident that began on October 6, when Fireworks detected misuse of internal credentials. Attackers accessed environment variables used by evaluation jobs, potentially capturing API keys and tokens. Fireworks began customer notifications on October 7 and later revoked affected keys, employee credentials, and service-account tokens. The company said the affected internal application exposed resource identifiers, names, descriptions, and creation times.

Customer data affected

Billing information in the breach included billing and shipping addresses, invoices, payment history, balances, and credit usage. Fireworks said it does not store payment card numbers and that those numbers were unaffected. For certain customers, attackers accessed a subset of incomplete model weights and datasets. The disclosure does not establish theft of complete production models. Fireworks also reported no detected impact to Inference, Training SDK, or Nexus, which operate with zero data retention by default.

Response and guidance

Fireworks said evidence points to a financially motivated cybercriminal group seeking to sell unauthorized access to large language models through illicit routing gateways, known as LLMJacking. It has notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic support. Its response includes replacing credentials, reducing elevated permissions, isolating affected systems, and tightening storage access. The company has disabled self-service dataset uploads and downloads for Batch Inference and dataset-based training during the investigation. Training SDK remains available, while Fireworks Lab-based training runs in an isolated environment with added network and storage protection. Fireworks is directly notifying customers whose data was affected. Its guidance advises affected users to replace revoked Fireworks keys and rotate exposed third-party credentials with their issuing providers. Deleting a stored secret does not invalidate the underlying credential. Customers should also review access logs, unfamiliar users, API keys, training jobs, and datasets for unauthorized activity.

Sources: Cybersecuritynews · Fireworks Ai · Bloomberg · Forbes