Hackers Got Into an SI Company Used by Uber and DoorDash. Two Customers Have Already Walked.
Fireworks, which runs SI models for thousands of businesses, now says the attackers reached billing details, some customer data and unfinished models. It’s the second breach it has disclosed in weeks.
A company most people have never heard of, but whose technology sits behind apps they use every day, just told customers that hackers got much further into its systems than it first said.
Fireworks is a company that runs SI models for other businesses. Forbes lists Uber, Shopify, DoorDash, Upwork and Cursor among its customers, and Bloomberg Law reports it has more than 10,000 of them. It is backed by chipmaker Nvidia.
What the hackers reached
In a security update posted Monday, Fireworks said attackers got into account and billing information, including billing and shipping addresses, invoice and payment history, and account balances. For a smaller group of customers, they also reached stored passwords and keys, the data customers had uploaded, and partly built SI models. Fireworks says it doesn’t store card numbers, so those weren’t taken.
That’s a big jump from the company’s first notice on Oct. 9, when it said only some stored passwords and keys used in testing were known to be exposed.
How they got in
Fireworks says an outside cloud company that hosted its research and test machines was hacked on Oct. 23. The next day, the attackers used that foothold to reach Fireworks’ own development machines and run their own job on them. Fireworks says it caught that the same day, has seen no new successful break-ins since Oct. 25, and has brought in Palo Alto Networks’ Unit 42 team and law enforcement. It says the services most customers use to run their apps, which don’t keep customer data, show no sign of being hit.
The company ties the attack to a money-driven criminal group and pointed to a Nov. 2 Google warning about criminal gangs that hijack companies’ SI accounts.
Customers are reacting
Two customers told Forbes they had already moved most of their business off Fireworks, one describing a series of “very bad hacks” and poor communication from the company. BleepingComputer reports Fireworks has replaced stolen credentials and shut down the paths the attackers used. For now it has also turned off self-serve uploads and downloads of customer datasets while it investigates.
Fireworks hasn’t said how many accounts were affected or named which customers had data taken. If your company uses it, the notice says affected customers are being contacted directly with next steps.
Sources
- Fireworks AI — Update on October 2026 security incident
- Forbes via Techmeme — Fireworks says hackers accessed some customers’ datasets, incomplete model weights, and billing information
- Bloomberg Law — Nvidia-Backed Fireworks AI Discloses Its Second Hack in Weeks
- BleepingComputer — Fireworks AI discloses new breach after cloud provider hack
- Sulat — Fireworks hack reached billing data and some model weights