Fireworks Hacked, Customers Want to Leave: Zero Data Retention Didn’t Protect Model Weights
The Information reports that Fireworks was hacked and exposed customer data, and that some customers are considering migrating. The official bulletin confirms that secrets, datasets, and incomplete model weights for a small number of accounts were accessed, while saying that the inference and training SDKs were unaffected. For teams doing private model training, this boundary is more worth watching than the phrase “zero data retention.”
Fireworks was hacked.
Stephanie Palazzolo of The Information reports that the highly valued inference provider has told customers including Harvey that the platform was hacked and customer data was exposed. Some customers are considering moving their business elsewhere.
Fireworks is the kind of platform companies use to run open-source and fine-tuned models. Companies don’t have to run their own GPUs; they can deploy inference, do training, and connect APIs on it. It is also one of the higher-valued companies among this wave of inference providers, so the impact of this incident is not limited to security teams.
On November 9, the company updated its security bulletin. The timeline is clear: on October 23, a security incident occurred at a third-party cloud provider hosting Fireworks R&D machines; on October 24, an unauthorized third party used that path to enter Fireworks development machines, run unauthorized workloads, and affect more customer data. Fireworks says it detected the activity that day and took action, and that after October 25 it found no further successful unauthorized access by attackers to the Fireworks platform used by customers.
The affected data falls into several categories: resource metadata, such as Fireworks resource identifiers, display names, descriptions, and creation times; billing information, such as billing and shipping addresses, invoice and payment history, account balances, and credit usage. The company says payment card numbers are not stored by Fireworks and were therefore unaffected. For a small number of accounts, the bulletin also mentions that secrets, datasets, and incomplete models were accessed.
There is a detail here that is easy to overlook. The bulletin explicitly says no impact was detected on Inference, the Training SDK, and Nexus, all three of which have zero data retention by default. In other words, the data retention policies for routine inference requests and the training SDK were not found to have been breached by this investigation. But “zero data retention” governs whether the platform retains data; it is not responsible for blocking development machines and third-party cloud entry points. What will really worry customers is the second half: for some customers, parts of incomplete model weights and datasets were accessed.
Model weights represent core assets for teams doing private fine-tuning. Even incomplete weights are not the same as a configuration file that can be made public. Datasets are even more direct; they may contain business corpora, labeled samples, and evaluation sets. The bulletin also says that in response, Fireworks has disabled self-service dataset uploads and downloads used for Batch Inference and dataset-based training. The Training SDK remains available and retains zero data retention.
The attackers’ motive is also spelled out. The evidence points to a financially motivated cybercriminal group whose goal is to sell tokens obtained from unauthorized access to large models to illegal routing gateways. Google Threat Intelligence Group and Mandiant published a blog post on November 2 about the rise of LLMJacking. Put simply, after stealing credentials, attackers can run models, resell tokens, mine crypto, extort clusters, or take data away. Some replies say this kind of thing is not limited to Fireworks and has occurred everywhere from neoclouds to startups with only a few GPUs.
The disagreement in the comments is also worth noting. Some people think customers leaving is an overreaction, since every platform now carries security risk. Some ask: does switching to another provider guarantee you won’t be hacked in the future? Others press the question of whether customer API keys or inference data were actually exposed. Some commenters question that without public logs and evidence, this kind of reporting is hard to verify. Another camp points to end-to-end encrypted inference and secure enclaves: if data is processed inside an enclave, a platform hack would not necessarily give attackers plaintext directly.
These debates do not change one fact: security promises need to be broken down. Zero data retention, SOC 2, and ISO certifications are all important information, but they answer different questions. The fact that customers are now considering migrating shows that trust cost has entered procurement decisions. For the platform, writing “no impact detected” in a bulletin is only an interim conclusion of the investigation; for customers, the fact that model weights and datasets were touched is the boundary that needs to be reassessed.
Sources:
发布时间: 2026-11-10 07:34