decrypted · 12 november 2026 · supply chain · ai and llm security · surveillance and privacy

A breach at an AI supplier's supplier exposed Notion users' chat transcripts

Last month the AI infrastructure firm Fireworks was breached twice, and this week one of its customers, Notion, confirmed that the fallout reached some of its users' AI chat transcripts. Their conversations simply sat somewhere they could not see, held by a supplier of a supplier.

What happened

Fireworks, a San Mateo company that runs AI models for more than 10,000 customers, says a financially motivated criminal group got in on 6 October and took account and billing information plus secrets, meaning stored credentials. On 23 October a third-party cloud provider hosting its research machines was attacked. The next day, Fireworks says, the intruder used that provider to reach development machines and run an unauthorised workload, exposing billing records, datasets and other AI data.

Notion used Fireworks to run open-weight models and to classify chats for its Insights feature, which shows workspace administrators how their teams use AI. Notion says transcripts were exposed in a small number of workspaces, fewer than 1% of users, and that most were unattributable, meaning not labelled with an author or workspace.

The courier and the warehouse

Imagine posting confidential letters through a courier who, unknown to you, rents shelf space in another firm's warehouse. The courier promised not to keep copies. Notion's own notice says Fireworks had contractually committed to zero data retention. Yet when someone breaks into the warehouse, the shelves are not empty. A promise on paper is not a control, and nothing on the sender's side would have shown the break-in.

What defenders saw

Nothing on their own network. Notion learned of a problem from Fireworks on 2 November, cut off traffic and deleted its data by 3 November, then received confirmation that customer data had been accessed. Notion has switched off Insights and tells workspace owners to review the affected data and rotate any passwords or API keys, the credentials programs use to talk to each other, that anyone typed into a chat.

That last instruction is the real lesson. People paste secrets into AI assistants as freely as they once did into email.

The Secure by Design lesson

The cheapest data to protect is data that no longer exists. Two decisions would have shrunk this incident. First, do not store prompts and transcripts longer than the job needs, and make deletion automatic rather than contractual. Second, give each supplier narrowly scoped credentials that expire, so a stolen key opens one door for an hour.

For a UK organisation, the practical step this week is three questions to every AI supplier: where do our prompts and transcripts rest, for how long, and which cloud provider holds them behind you? Under data protection law you stay answerable for what your suppliers do with personal data, and a chat log full of client names is personal data. If the answers are vague, assume your staff's secrets may live there indefinitely. Opinion, not advice.

Also this week

Policy: a voluntary code for spyware sellers. On Wednesday, 14 governments in the Pall Mall Process, the effort led by the UK and France, adopted the first guidelines for commercial hacking firms, according to The Record. Firms that make, sell or finance intrusion tools are asked to vet customers, build in safeguards against misuse and halt sales when serious abuse is a credible risk. The guidelines are non-binding and carry no penalties, and fewer than half of the 43 countries at the conference signed. The French foreign ministry itself said they create no new legal obligations, adding that a voluntary code is not an optional one. The test is whether governments that buy and license these tools actually apply the pressure.

Breach: Maersk and the system it inherited. Maersk confirmed that an attacker breached a system belonging to a company it previously acquired and stole data. It says the incident is isolated to a local system and that it has found no sign of impact on other Maersk, customer or partner systems. A ransomware gang called WhiteArmor claims about 100 gigabytes and demands $5 million, pointing to a logistics platform from a business Maersk bought in 2022. Those claims are the gang's, unverified, and Maersk has not said which system was involved. The design point is plain: acquired systems should be fenced off and retired on a deadline, not left to become the quiet side door.

Supply chain: managed providers as the way in. Security firm Huntress reports an active campaign in which attackers use compromised ScreenConnect remote access at managed service providers, the outsourced IT firms that run clients' machines, to push rogue remote clients onto customer devices. It counts six providers and 286 endpoints across 47 organisations so far. Huntress describes it as abuse of legitimate functionality, and it does not yet know how the first provider was compromised. ConnectWise has disabled five third-party extensions as a precaution. If an outsourced IT firm supports you, ask them today how their technicians are authenticated and what you would see if one session were hijacked.

Sources

If you want help asking your suppliers the awkward questions, get in touch.