How to Check Your Notion Workspace After the Breach

Notion has told customers that a breach at Fireworks AI, the company that ran some of its AI models behind the scenes, exposed Notion AI chat transcripts from fewer than 1% of workspaces. Notion’s own systems were not breached — but if your workspace is one of the affected ones, anything you typed into Notion AI, including passwords and API keys, may have been seen by attackers. This guide walks through exactly how to check whether you were affected and what to rotate, in about five minutes.

Quick answer: A Fireworks AI breach exposed Notion AI chat transcripts in under 1% of workspaces. Check your email and Notion's incident review, then rotate secrets.

What actually happened

The short version: an attacker broke into Fireworks AI, an AI infrastructure company Notion used as a vendor. The data the attacker reached included a set of Notion AI chat transcripts that Notion had sent to Fireworks for a usage-analysis feature called Insights. Notion says it cut Fireworks off on 3 November, has disabled Insights, and has contacted every affected customer directly.

The longer version matters, because Notion’s own account of the incident changed over a week — first it looked like only test data, then it turned out to be real customer chats. Here is the timeline, from Notion’s security advisory (first published 9 November 2026, updated 10–13 November) and Fireworks AI’s own security bulletin (updated 9 November 2026).

Date (2026)	What happened
6 October	Fireworks identifies unauthorised use of its internal credentials; secrets stored for evaluation jobs in a limited number of accounts are accessed. It starts notifying affected customers on 7 October and publishes a bulletin on 9 October.
23–24 October	A third-party cloud provider hosting Fireworks’ research machines has a security incident. On 24 October the attacker uses it to reach Fireworks’ development machines and run an unauthorised workload. Fireworks says it detected the activity the same day and found no further successful access after 25 October.
2 November	Fireworks tells Notion a small dataset was accessed. Notion investigates and concludes it holds only synthetic Notion AI test data, with no customer data involved.
3 November	Notion disconnects from Fireworks, deletes all its data held there and stops all communication with the vendor. Training runs are halted.
6 November	Fireworks tells Notion that malicious actors may have accessed potential customer data.
8 November	Fireworks confirms the final affected dataset. Notion’s analysis finds it contains Notion AI chat transcripts used for its Insights feature.
9 November	Notion publishes its security advisory and starts contacting affected customers.
11 November	Notion revokes exposed Notion API keys it found inside affected users’ chat messages.
12 November	Notion reports exposed third-party API keys found in affected messages to the vendors that issued them. TechCrunch confirms the scale the same day.

Fireworks links the attack to a financially motivated group that sells unauthorised access to AI models — activity researchers call LLMjacking. It says it notified law enforcement and brought in Palo Alto Networks’ Unit 42 for forensics. Its investigation is still open.

Notion is explicit on one point: “this was not a breach of our systems.” The exposure happened one layer down, at a vendor most Notion customers had never heard of, let alone evaluated.

Notion is not the only Fireworks customer to surface fallout. Cursor said in a 13 November update that its own October security incident began with a key exposed at Fireworks. Fireworks itself has not published a named list of affected customers.

Was your workspace affected? Check in two minutes

Do this check before you change anything. Notion says it has contacted every affected customer, and that if you have not been contacted, your workspace has not been identified as affected.

Check your email — and your workspace owner’s inbox. Notion began contacting affected customers on 9 November 2026. The notice goes to the workspace owner, so if you are a member rather than the owner, ask them. Check spam and any shared admin mailbox too.
Open Notion on desktop or the web app and look for the incident review. Workspace owners can open the sidebar, click the ? help menu, and choose Security incident review. If your workspace was affected, the review option appears there with instructions.
No email and no review option means no action is needed for now. That is Notion’s own position: it says it will contact you directly if its investigation changes that assessment.
If you were notified, retrieve your transcripts. Notion says affected customers can retrieve and review the impacted data securely inside their workspace, using instructions sent by email. Workspace owners can also share a link that lets members download their own transcripts, so each person can see what of theirs was in the exposed chats.

Do not trust a message about this incident that arrives from an unfamiliar sender or asks you to log in through a link. Go to Notion yourself — open the app or type the address — and check the review option there.

What to do if you were notified

Being notified does not mean your Notion account was hacked. It means some of your Notion AI chats were in the dataset the attacker reached. Work through this ladder in order.

Read the transcripts Notion gives you. Look specifically for anything that is not just words: passwords, API keys, tokens, private links, internal URLs, customer names, or anything you would not want published. That list is your rotation list.
Rotate every secret on that list, starting with the most powerful. Change the password or regenerate the key at the service that issued it — in that service’s own settings, not in Notion. Then update every place that secret is used, including scripts, integrations and other team members’ copies.
Do not assume Notion’s revocations cover you. Notion revoked the Notion API keys it found in affected messages on 11 November, and reported third-party API keys to their issuers on 12 November. That covers keys Notion could see. It does not cover a database password, a personal token, or a key from a service Notion never identified.
Check where else each secret was used. A key pasted into one AI chat may also live in a shared doc, a screenshot, or a teammate’s notes. Rotate it everywhere, or the rotation is cosmetic.
Keep using Notion AI normally if you were not notified. Insights is disabled while Notion investigates, and Notion no longer serves open-weight models through Fireworks. There is nothing to switch off on your side.

One thing Notion has not said is that Notion account passwords were exposed, and there is no evidence in the reporting so far that they were. Rotating a secret that appeared in an exposed chat is the specific action Notion asks for; changing your Notion password on top of that is harmless, but it is not a substitute for rotating the secrets that were actually in the chats.

What was exposed — and what was not

Data	Status	Detail
Notion AI chat transcripts used for Insights	Exposed (affected workspaces only)	What users typed to Notion AI and what it replied, as stored for Insights classification. Fewer than 1% of workspaces, per Notion.
Author and workspace labels on those chats	Mostly absent	For the vast majority of affected workspaces the transcripts were unattributable — no label saying who wrote them or which workspace they came from — and they contained no tool call results.
Pages, databases and files in Notion	Not affected	Notion says no other Notion features were affected. Your stored workspace content was not part of this incident.
AI Meeting Notes audio, transcripts and summaries	Not affected	Unless the content was pasted into a Notion AI chat, meeting notes were not in the exposed dataset.
Notion account passwords and payment data	No evidence of exposure	Nothing in Notion’s advisory or the reporting so far says these were involved. Fireworks separately says it does not store payment card numbers.

The bigger lesson: your AI chats live somewhere else too

The detail that should worry every AI user here is not the size of the breach — under 1% of workspaces — but how the data got there. Notion sent stored Notion AI requests and responses to Fireworks so Fireworks could classify them for Insights. Fireworks had given Notion what Notion calls “a contractual commitment to zero data retention” for its platform. During the investigation, Notion learned data was retained from the Fireworks endpoints it used anyway.

Notion’s own help page draws a careful line: its zero-data-retention commitment applies to the API requests it sends to third-party model vendors, and is “not intended to cover these use cases where we are required to retain the data to deliver the feature.” In other words, the promise covered the model call, not the analytics copy of your chat sitting on a vendor’s system. That distinction is worth five minutes of your time, because Notion is not the only product that works this way.

Our take — run a five-minute prompt-whereabouts audit. List every tool where you paste real work into an AI chat: Notion AI, ChatGPT, Claude, Gemini, your coding assistant, your meeting notetaker. For each one, find its sub-processor list and its data-retention policy. You are looking for one sentence — does your prompt data go to a third party, and for how long is it kept? If you cannot find the answer in five minutes, treat that tool as one that keeps your prompts, and stop pasting secrets into it. The practical rules are simple: never paste a live password, API key or token into any AI chat; keep secrets in a password manager and paste only the result you need help with; and when you connect an AI tool to your apps, check what it can read first — the same permissions audit we recommend when connecting an AI assistant to your Mac apps. If you build with APIs, the same discipline holds for keys in code: our DeepSeek API tools guide shows how API keys should be handled, not pasted into chat windows.

The uncomfortable truth this incident exposes is that your AI chats are only as private as the least careful vendor in the chain behind your app — a vendor you never chose, never contracted with, and in most cases never heard of. Notion’s response has been fast and unusually open, and that counts for something. But the check that matters is the one you run yourself, on every tool you trust with your words.

Frequently Asked Questions

Was Notion itself hacked?

No. Notion says its own systems were not breached. The attacker broke into Fireworks AI, a vendor that processed some Notion AI data, and reached Notion AI chat transcripts stored there for the Insights feature.

How do I know if my workspace was affected?

Notion contacted affected customers by email starting 9 November 2026. Workspace owners can also check inside Notion: open the sidebar, click the ? menu, and choose Security incident review. If you received no notice and see no review option, Notion says your workspace has not been identified as affected.

What exactly leaked?

Notion AI chat transcripts — the prompts users typed and the AI’s replies — that Notion had sent to Fireworks to classify for its Insights feature. For most affected workspaces the transcripts carried no author or workspace label and no tool call results. Pages, databases, files and meeting notes were not in the exposed dataset.

Should I change my Notion password?

Notion has not said account passwords were exposed, and no reporting so far suggests they were. The action Notion asks for is to rotate any credential that appeared inside an exposed AI chat. Changing your Notion password as well is harmless, but it does not replace rotating the secrets that were in the chats.

Is it safe to keep using Notion AI?

Notion cut Fireworks off on 3 November, deleted its data there, disabled Insights while it investigates, and no longer serves open-weight models through Fireworks. If you were not notified, Notion says no action is needed. The investigation is ongoing, so check Notion’s advisory for updates rather than treating this as closed.

Sources and methodology

Claims in this article rest on Notion’s security advisory (“Security incident involving a third-party AI vendor”, first published 9 November 2026, updated 10–13 November) and Fireworks AI’s security bulletin (“Update on October 2026 security incident”, updated 9 November 2026), as reported by BleepingComputer (Bill Toulas, 11 November 2026) and TechCrunch (12 November 2026), and cross-checked against five independent secondary write-ups. All figures are Notion’s or Fireworks’ own unless labelled otherwise. Verified 15 November 2026. Desk-researched, not hands-on tested — no affected workspace was available to us, and the check steps are Notion’s published instructions, not a test we ran.

Govind Dheda

Govind Dheda covers AI tools, guides and prompts for OpenAIMaster — what is new, what is worth using, and how to put AI to work.