# Fireworks Confirms Second Breach as Large Customers Weigh Exits

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/53583
Published: 2026-11-11T04:59:38.000Z
Updated: 2026-11-11T04:59:38.000Z
Section: Technology

> The Nov. 9 disclosure covered customer billing information, datasets and unfinished model weights. Two customers have moved most of their business away from the AI provider.

Fireworks acknowledged Nov. 9 that a second intrusion exposed some customers’ billing information, datasets and unfinished model weights, as large clients consider moving workloads away from the AI inference provider.

The breach began Oct. 24, when an attacker entered Fireworks’ development machines through a compromised cloud provider and ran unauthorized code. Fireworks said payment card numbers were not exposed and its core online inference services were not affected.

An earlier intrusion in early October involved stolen internal credentials and some customer API keys used for model evaluations. At the time, Fireworks said it had found no access to customer models or datasets.

Two customers have moved most of their business away from Fireworks, while some large clients that pay millions of dollars a year are weighing provider switches.

Fireworks had annualized revenue of $1 billion in July and a $17.5 billion valuation. The company had planned a new fundraising round that could target a valuation above $30 billion.

Fireworks has suspended some data upload and download functions and brought in Unit 42, Palo Alto Networks’ cybersecurity unit, to investigate. The company said attackers may be linked to a black market that steals and resells AI model usage credits.