Notion API keys revoked after Fireworks transcript exposure

Contents

At a glance

Notion's 11 November update reports revoked API keys found in affected chats. The company gives customers instructions to review exposed data.

Keys found inside affected messages

Notion said on 11 November 2026 that it had revoked exposed Notion API keys discovered in affected users' messages during its investigation of the Fireworks AI incident. The update adds a concrete account-protection measure to the company's earlier disclosure about chat transcripts held by its AI supplier.

Notion says the incident affects fewer than 1% of its workspaces. It has contacted identified customers and disabled Insights, the feature for which the affected transcripts were used. These findings describe the company's investigation; they do not mean every Notion conversation was exposed. [1]

How the disclosure developed

Notion's chronology separates its first notification from confirmation of customer data. Fireworks contacted it on 2 November about a dataset initially assessed as synthetic test material. By 3 November, Notion had disconnected from Fireworks and removed its data there.

A further warning on 6 November prompted another investigation. Fireworks confirmed the affected dataset on 8 November, and Notion contacted customers on 9 November. The fresh development is the key revocation on 11 November, rather than a newly dated intrusion. [1]

What Fireworks reports

Fireworks' separate bulletin, updated on 9 November, describes a cloud supplier's security incident on 23 October and access to Fireworks development machines on 24 October. It says an unauthorized workload caused additional customer-data impact and that it detected the activity that day.

The supplier reports affected account and billing information, and, for certain customers, datasets and incomplete model weights. It says it does not store payment-card numbers. Fireworks also reports replacing credentials, restricting network access and strengthening logging while working with Unit 42. It suspended self-service dataset transfers used by Batch Inference and dataset-based training during the investigation. [2]

What affected customers should review

Notion has sent affected customers instructions for retrieving and reviewing their workspace data securely. It advises treating the material as exposed and replacing any passwords, API keys or other credentials pasted into affected conversations.

Fireworks distinguishes the affected stored datasets from its Inference, Training SDK and Nexus services, for which it reports no detected impact and describes zero data retention by default. Its investigation remains open. Customers should follow the notice for their own service and data, rather than assuming that one supplier-wide statement describes every product. [1][2]

Evidence & sources

Source record: Nov 11, 2026 · Checked: Nov 12, 2026

Record limits · Sources checked on 12 November 2026; both investigations remain ongoing.

[1]Source reported
Notion reports revoking exposed API keys and notifying affected customers.
Supporting excerpt: Fireworks AI incident
Original quotation
we revoked exposed Notion API keys found in affected users’ messages during our investigation.
Fireworks AI incident ↗
Source language: EN · Captured Nov 12, 2026
[2]Source reported
Fireworks describes affected data and its continuing investigation.
Supporting excerpt: Update on October 2026 security incident
Original quotation
Our investigation is ongoing and may reveal additional information.
Update on October 2026 security incident ↗
Source language: EN · Captured Nov 12, 2026