Fireworks AI, a startup backed by Nvidia and AMD, has notified customers of a second security breach within weeks, according to a company spokesperson. The firm, which supports over 10,000 clients—including Notion, Cursor and legal tech company Harvey—said an unauthorised party accessed data via an external cloud provider on 24 October. The breach involved tens of thousands of files, with some containing customer data, a source told Insurance Journal.
Earlier in October, Fireworks AI disclosed a separate breach involving internal credentials, which affected customer accounts and billing data. The company’s investigation, supported by Palo Alto Networks and law enforcement, found that a cybercriminal group was behind the earlier incident. For some accounts, the breach also impacted sensitive items such as datasets and incomplete models.
Fireworks AI said it is working directly with affected customers and did not name the party responsible for the most recent breach. The firm, last valued at $17.5 billion, is in talks for a new funding round that could value it as high as $40 billion, according to people familiar with the matter.
For insurers, healthcare firms and banks, the events highlight the risks of relying on external AI vendors for critical operations. Vendor security and incident response protocols may need urgent review.
