What changed after the first notice
When Fireworks AI notified customers in early October, its account centered on credentials stored for evaluation jobs. At that point the company said it had found no evidence of access to customer datasets or models within its systems. Its November 9 bulletin changes that assessment: some datasets and incomplete model weights were accessed. It also identifies account metadata and billing records among the information exposed. Fireworks says it does not store payment card numbers.
A second date for the incident record
Fireworks dates the initial discovery to October 6. Its new account describes separate activity on October 24 involving development machines hosted by a cloud provider. Fireworks says it detected that activity the same day and brought in Unit 42 to assist its investigation. The November notice does not say every customer exposed in early October was affected again. A customer trying to reconcile the notices needs the individual notification to tell which data and which dates apply.
Why a retention promise answers only part of the question
A company can send no prompts for storage and still leave a substantial business record with a service provider: who pays the bill, which resources exist and what material has been supplied for training. Those records serve different purposes and follow different paths. Fireworks says it found no impact to its inference service, Training SDK or Nexus, while suspending some self-service dataset transfers. For buyers evaluating the incident, those findings can coexist. A clean inference history would not settle what happened to a dataset uploaded separately.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
