The makers of the productivity software Notion have revealed that hackers might have accessed some users’ AI chatbot transcripts. In some cases, these logs could have contained passwords and other sensitive info, with affected customers told to “treat this data as if it were exposed.”
Notion detailed the security incident in a blog post, where it said that its Insights feature – which is designed to help users understand their Notion AI usage and is powered by an AI infrastructure provider called Fireworks – lay at the heart of the breach. Notion has disabled Insights and is no longer using open-weight AI models through Fireworks, the company said.
Fireworks issued its own report, where it linked the attack to “a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways,” a practice known as LLMJacking. Fireworks said it worked with Unit 42 of cybersecurity firm Palo Alto Networks to revoke affected credentials and strengthen its defenses against future attacks.
How the breach unfolded
Notion first learned of the incident on November 2, when Fireworks told Notion that “a small set of data had been accessed by malicious actors,” according to Notion’s post. On November 6, Fireworks reported that hackers “may have accessed potential customer data.” Notion began another investigation, and Fireworks confirmed the data set on November 8 and customers were notified the next day.
Notion said that fewer than 1% of its workspaces were affected and that “the vast majority of impacted workspaces were unattributable,” meaning that their AI chats “weren’t labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.”
However, the wording used – saying “the vast majority” were unattributable – suggests that a small number of workspace AI chats could be attributable. CISO Voice has contacted Notion for comment.
The company said that it has contacted all customers affected by the breach. Users who haven’t received a message are not required to take any action, as Notion said this lack of contact means the workspace has not been identified as being impacted.
Affected users are advised to retrieve and review the data involved in their workspace. Any such data should be treated as exposed – if that includes passwords, API keys or other sensitive information, they should be rotated as soon as possible.
