Fireworks AI first disclosed an incident in October, saying only environment variables and secrets in some evaluation jobs were taken. Now it says the damage went further.
What’s new
Attackers reached Fireworks’ development machines through an unnamed third-party cloud provider hosting its R&D boxes, then ran a workload that hit more customer data. For a limited set of accounts that includes resource metadata, billing and shipping addresses, invoice and payment history, balances and credit usage, and some incomplete model weights and datasets. Card numbers weren’t stored, so they weren’t taken. Fireworks links it to a financially motivated group that resells stolen LLM access to illicit routing gateways.
What to do
If you use Fireworks, rotate every API key and any secret you ever put in an eval job, check your usage for spend you don’t recognize, and watch for their notice. Breaches like this keep getting bigger after the first disclosure, which is why I rotate early.
God Bless, and Needs Garlic!
