[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS9KOUgzUjaFaOdQ3u8v3jMnJTaWXcfinY9wCjKW30oM":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"d1a436e5-9e82-45e4-a5c8-b3cda301fbe1","Notion Customer Data Compromised in Fireworks AI Hack","notion-customer-data-compromised-in-fireworks-ai-hack-a39fcf","The attackers accessed chat transcripts for fewer than 1% of Notion workspaces. Most transcripts were unattributable. The post Notion Customer Data Compromised in Fireworks AI Hack appeared first on SecurityWeek.","Notion is notifying customers about a data breach involving Fireworks AI, a platform for AI models. Attackers gained unauthorized access to Notion AI chat transcripts used for the Insights feature. Fewer than 1% of Notion workspaces were affected, and most transcripts were unattributable. Notion advises affected customers to treat the data as exposed and rotate any compromised credentials.","Notion AI chat transcripts accessed in Fireworks AI hack affecting less than 1% of workspaces.","https:\u002F\u002Fwww.securityweek.com\u002Fnotion-customer-data-compromised-in-fireworks-ai-hack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F10\u002Fbank-finance-lender-credit-union-hack.jpeg","2026-11-12T11:08:52+00:00","2026-11-12T12:00:19.298749+00:00",7,[17,20,23,25],{"name":18,"type":19},"Notion AI","product",{"name":21,"type":22},"Notion","vendor",{"name":24,"type":22},"Fireworks AI",{"name":26,"type":27},"LLMJacking","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[],[21,24,18],{"controls":49,"vendors":134},[50,79,105],{"slug":51,"name":52,"problem":53,"products":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":80,"name":81,"problem":82,"products":83},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":101,"product_name":102,"url":103,"description":104},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":106,"name":107,"problem":108,"products":109},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"third-party-ai-vendor-breach-exposes-notion-customer-chat-data","Third-Party AI Vendor Breach Exposes Notion Customer Chat Data","Notion's customer data was compromised not through a direct attack on Notion itself, but through a breach of Fireworks AI, a third-party vendor handling AI chat transcripts for the Insights feature. This is a classic supply chain security failure: sensitive customer data was processed and stored by an external platform that became the attack surface. The incident highlights the risk of extending trust implicitly to vendors who handle personal or sensitive data on your behalf. Even when a company's own security posture is strong, a weaker link in the vendor chain can expose customer data at scale. Organizations must treat third-party data processors as extensions of their own security perimeter and hold them to equivalent standards.",[140,141,142,143,144],"NIS2 Article 21(2)(d)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIST SP 800-53 SA-9: External System Services","GDPR Article 28","CIS Control 15: Service Provider Management",{"GDPR Article 28":146,"NIS2 Article 21(2)(d)":147,"CIS Control 15: Service Provider Management":148,"NIST SP 800-53 SA-9: External System Services":149,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":150},"Article 28 mandates that controllers only use processors who provide sufficient guarantees about data protection, and requires a binding contract specifying security obligations — gaps here enabled customer personal data to be exposed through the vendor.","This point specifically requires organizations to address security risks arising from supplier and third-party relationships, which is precisely what failed when Fireworks AI — a data processor for Notion — was compromised.","This control requires organizations to establish and maintain an inventory of service providers and assess their security practices, which would have identified Fireworks AI as a high-risk processor of sensitive customer data requiring heightened oversight.","SA-9 requires organizations to establish requirements for external service providers and monitor their compliance, which would have surfaced whether Fireworks AI maintained adequate controls over Notion's customer data.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have included assessing and monitoring Fireworks AI's security posture before entrusting it with customer chat transcripts."]