[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fttahpLVMkFzj4H64pnvTY4-gM7rojbNhglxK3Yy61zQ":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b36ea277-6391-4872-b7c2-be0b9a783a3e","Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach, Affecting Customer Workspaces","notion-confirms-ai-chat-transcripts-exposed-in-fireworks-ai-breach-affecting-cus-365e5f","Notion has confirmed that a security incident at Fireworks AI exposed Notion AI chat transcripts linked to fewer than 1% of its customer workspaces. Insights, a feature that helps teams understand their AI usage, used the affected conversations. Notion said its own systems were not breached and no other Notion features were affected. The company […] The post Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach, Affecting Customer Workspaces appeared first on Cyber Security News.","Notion has confirmed that a security incident at Fireworks AI led to the exposure of Notion AI chat transcripts for less than 1% of its customer workspaces. These transcripts were used by the 'Insights' feature to track AI usage. Notion stated that its own systems were not breached and no other features were affected. Affected customers have been notified and advised to review their data and change credentials pasted into Notion AI.","Notion AI chat transcripts exposed due to a breach at Fireworks AI.","https:\u002F\u002Fcybersecuritynews.com\u002Fnotion-confirms-data-breach\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FNotion-Confirms-Data-Breach-.webp","2026-11-10T16:54:37+00:00","2026-11-10T17:00:27.276468+00:00",7,[17,20,23],{"name":18,"type":19},"Notion AI","product",{"name":21,"type":22},"Fireworks AI","vendor",{"name":24,"type":19},"Insights","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[],[21,18,24],{"controls":46,"vendors":134},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":77,"name":78,"problem":79,"products":80},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":106,"name":107,"problem":108,"products":109},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"third-party-ai-provider-breach-exposes-notion-customer-chat-transcripts","Third-Party AI Provider Breach Exposes Notion Customer Chat Transcripts","Notion's exposure of AI chat transcripts stemmed not from a flaw in its own systems, but from a breach at Fireworks AI, a third-party provider powering the Notion AI 'Insights' feature. This is a classic supply chain security failure: Notion's customers trusted Notion, but their data was at risk through a vendor Notion trusted. The incident highlights that sensitive customer data — including potentially credentials pasted into AI chats — can be exposed even when your own infrastructure is secure. Organizations must treat third-party data processors as an extension of their own attack surface and apply commensurate due diligence and contractual controls.",[140,141,142,143,144],"NIS2 Article 21(2)(d)","NIST SP 800-53 SA-9: External System Services","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality","GDPR Article 28",{"GDPR Article 28":146,"NIS2 Article 21(2)(d)":147,"NIST SP 800-53 SA-9: External System Services":148,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":149,"NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality":150},"Article 28 requires that data controllers use only processors providing sufficient guarantees and bind them via contract to process data only as instructed and securely — obligations directly applicable to Notion's relationship with Fireworks AI as a sub-processor of EU customer data.","This point explicitly requires organizations to implement security measures addressing supply chain risks, including the security practices of direct suppliers and service providers like Fireworks AI.","SA-9 requires organizations to define and enforce security requirements for external providers and monitor their compliance — controls that would have set expectations for Fireworks AI's data protection obligations.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have included security vetting and contractual obligations for Fireworks AI.","This category asks organizations to identify and prioritize suppliers based on the criticality of the data they handle, which would have flagged Fireworks AI as a high-priority vendor given its access to customer AI transcripts."]