A company most small business owners have never heard of just had its second security breach in two months — and the fallout landed on customers of a tool many of them use every day.
Fireworks AI, a company that provides backend infrastructure for running AI models, disclosed that attackers accessed chat transcripts belonging to customers of Notion, the popular workspace and note-taking app. Notion uses Fireworks to power some of its AI features, meaning the breach didn't happen inside Notion's own systems — it happened one layer down, at a vendor most Notion users never see or think about.
This is the second confirmed incident at Fireworks in as many months. Details on the first breach were limited, but the recurrence suggests the company's security problems were not fully resolved after the initial event. Neither Fireworks nor Notion has published a full accounting of how many users were affected or what specific data was exposed beyond chat transcripts, which can contain anything from meeting notes to draft client proposals to passwords pasted in for safekeeping.
The arrangement between Notion and Fireworks reflects how most AI features get built today. Rather than train and host their own models, software companies routinely plug into third-party infrastructure providers to add AI chat, summarization, or search to their products. That makes AI features cheaper and faster to ship, but it also means a security failure at an obscure backend vendor can expose data from millions of users of a well-known app that had no direct involvement in the breach.
This incident fits a pattern that's become familiar in the past two years: breaches increasingly occur not at the software companies users interact with, but at the infrastructure and AI vendors sitting behind them. Security researchers have flagged this as a growing blind spot, since most companies vet their direct software vendors but rarely demand visibility into who those vendors, in turn, rely on. A repeat breach at the same provider, within such a short window, adds a second layer of concern: it raises questions about whether the vendor's incident response actually fixed the underlying vulnerability or simply patched the immediate hole.
For small businesses, the practical risk isn't abstract. If your team uses Notion's AI features — for drafting documents, summarizing meetings, or searching internal notes — any sensitive information typed into those chats may have passed through Fireworks' infrastructure and could be among the exposed data. That includes financial figures, client names, HR matters, or anything else staff assumed stayed private inside a work tool.
The bigger issue is that most businesses have no way to audit this kind of exposure themselves. You can review Notion's own security practices, but very few companies ask software vendors to disclose which AI infrastructure providers sit behind their features, let alone that provider's breach history. This incident is a reminder that the AI tool you signed a contract with may not be the only company holding your data.
This week, it's worth doing three things: check whether your team used Notion's AI chat or assistant features recently and flag anything sensitive that was typed in; review Notion's official breach notifications for specifics on whether your account or workspace was affected; and ask any vendor providing AI features whether they rely on third-party model providers, and what those providers' security track records look like.
Watch for Notion's formal disclosure to affected customers, any regulatory notifications required in jurisdictions with breach-reporting laws, and whether Fireworks loses other enterprise clients as a result. A second breach in two months is the kind of pattern that tends to trigger customer attrition, even when the direct damage is contained.
The bottom line: this breach underscores that AI features built into familiar software often depend on third-party infrastructure most users never see, and a security failure there can expose your data even if the app you trust wasn't directly hacked.