AI Inference Platform Fireworks Breached, Some Customer Data Affected

According to TechFlow on November 10, Fireworks' official security advisory said a recent security incident affected customer account and billing information; keys, datasets, and incomplete model weights for a small number of accounts were also affected.

Fireworks said a security incident occurred on October 23 at a third-party cloud provider hosting its R&D machines; the next day, attackers used it to access its development machines and run unauthorized tasks, causing additional customer data impact. The company said no further successful access by the attacker to the platform used by its customers has been detected since October 25.

Affected information includes billing addresses, invoices, and payment records; Fireworks said it does not store payment card numbers, and card numbers were not affected. The company is investigating with Unit 42, part of Palo Alto Networks, and has temporarily disabled self-service dataset upload and download functionality used for batch inference and dataset-based training.

Source: TechFlow