Notion data breach

Notion announced a data breach on Nov 10, 2026. The number of people affected has not been disclosed. It happened through a vendor (Fireworks AI (AI inference provider)). No settlement or compensation has been announced.

What happened

Notion said on November 10, 2026 that a breach at Fireworks AI, a third-party AI infrastructure provider it used for open-weight models, exposed Notion AI chat transcripts used for its Insights feature in fewer than 1% of Notion workspaces. Fireworks first told Notion on November 2 that a dataset had been accessed, and confirmed the final affected dataset on November 8; Notion contacted affected customers on November 9 and on November 11 revoked Notion API keys found in affected messages. For most affected workspaces the transcripts are unattributable, meaning they are not labeled with the author or workspace and contain no tool call results. Notion says its own systems were not breached, it has cut off and deleted data at Fireworks, and Insights is disabled during the investigation.

What should I do?

1. If Notion contacted you, review the affected transcripts through the security incident review in Notion's desktop or web app and treat that data as exposed.
2. Rotate any passwords, API keys or other credentials pasted into Notion AI chats during the incident period, including Notion API keys.
3. Workspace owners should share the download link with members so they can check their own transcripts.
4. Be wary of emails about this incident asking you to sign in; open Notion directly instead of clicking links.

More data breaches in the United States →

Check the other services you use →