AI infrastructure company Fireworks said cybercriminals stole billing information and AI-specific data during two breaches last month. Fireworks published an updated notice on Monday saying it hired Palo Alto Networks Unit 42 to investigate a data breach it initially discovered on October 6. The San Mateo-based company was founded in 2022 and has more than 10,000 customers, offering an array of AI systems and tools to companies. Investigators found that a well-known, financially motivated cybercriminal group launched the attack and stole account and billing information as well as secrets — confidential digital pieces of information that grant access to human users or apps and allow them to communicate or perform actions. Fireworks said the incident affected a “limited number of customer accounts” — all of whom were notified of the attack. Monday’s alert from Fireworks also notes that the company experienced another incident on October 23 where a third-party cloud provider that hosted their R&D machines was attacked by cybercriminals. “On October 24, the unauthorized third party used [the provider] to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact,” the company said. The hackers gained access to internal Fireworks data, billing information, invoices and payment history as well as datasets and other AI-related data. The customers that were impacted have been notified. Fireworks is working with Palo Alto Networks on hardening its security posture and revoking compromised credentials. Digital workspace company Notion released its own notice that some of its customers were impacted by the Fireworks breaches. The company said it was notified of the incident on November 2 and disconnected its systems from Fireworks, deleting all data in the Fireworks system. “On November 6, Fireworks notified us that malicious actors may have accessed potential customer data. Our team immediately began another internal investigation,” the company said. “We used Fireworks for classification jobs to help customers understand their own AI usage through a feature in Notion called Insights, and we used them as a general inference provider to serve open-weight models inside our product. The Insights feature has been disabled as we investigate this incident, and we are no longer serving open-weight models through Fireworks.” LLMJacking Fireworks said its breaches are part of a larger string of attacks recently spotlighted by incident responders at Google. Google Threat Intelligence Group (GTIG) and Mandiant published a blog last week about a tactic known as “LLMJacking” where hackers hijack an enterprise’s access to large language models. Mandiant said it has responded to multiple LLMJacking incidents in 2026 spanning a variety of cloud and LLM providers while impacting “organizations in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors.” “Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours,” the researchers explained. “Across individual incidents, we observed fraudulent charges associated with resource consumption exceeding $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked.” GTIG said it has identified a “diverse set of financially motivated threat clusters operating out of multiple regions globally” that are responsible for the attacks. The groups are also maturing — with some focusing on initial access before handing off to other groups that monetize and resell the unauthorized access to large language models. Multiple investigations showed the groups were primarily trying to steal tokens or credentials which allow threat actors to establish footholds into target organizations’ infrastructure. “As enterprises integrate higher-tier models and agentic workflows into production environments, cybercriminals will likely refine automated reconnaissance to target exposed API tokens and exploit vulnerabilities in model routing middleware,” GTIG said. “This operational specialization will sustain a growing illicit resale marketplace, allowing threat actors to rapidly siphon enterprise quotas while passing the billing costs to victims before compromises are detected.”
Click Here For The Original Source.
——————————————————–
