Fireworks tells large customers of a recent, more serious hack

The Information reports that Fireworks told some large customers of a new, more serious hack. Fireworks is a startup that helps developers run and train open-source models. The article names Harvey, the legal AI company, as one of the customers Fireworks notified. The Information says the hack exposed data from some Fireworks customers. Reporter Stephanie Palazzolo cites two people with knowledge of the breach. The full article is paywalled, so this item relies on the three facts above.

What the three facts mean to a reader

A customer that sent prompts, embeddings or fine-tuning data through Fireworks has to assume it could be in the breach. The size of the exposure is not public. Fireworks has not said what parts of its systems were reached. Harvey being the named customer matters for one reason. Harvey's customers are law firms and in-house legal teams. A prompt sent through Harvey is often a client document, a contract or a question about ongoing work. If any of that passed through Fireworks and was exposed, the duty to tell users reaches more than one company. The law firm, Harvey and Fireworks all carry a share of it.

What a team that uses Fireworks should do this week

Ask Fireworks what parts of the service were reached, which account types, and what time window the exposure covers. Ask whether the data was prompt text, model outputs, training data, logs, keys, or metadata. Rotate every API key held for Fireworks and every key the service has ever held on a team's behalf. Check who on the team has admin access there. Read the outbound logs to the Fireworks hostname for the last few weeks. Compare the volume to what the team expected. A spike or a request from an unfamiliar address is worth a question.

What is still open

The Information is one outlet. No public statement from Fireworks is visible yet. Harvey has not said whether any of its own customer data was in the exposure. It has not said whether notifications have gone to end users. No regulator has commented either. Watch Fireworks' status page and its own blog for a disclosure. A second independent source would raise or lower the floor on what customers need to do. Until then, the three facts in the paywalled article are the basis for the item. A breach was described to customers. Harvey was told. Data was exposed. Everything above is the reader's own action in light of that.

Source

Stephanie Palazzolo, The Information, "New Fireworks Hack Threatens $1 Billion Business".