Notion Data Breach: What It Means for Your Business

The Notion data breach did not start at Notion. It started at Fireworks AI, an AI infrastructure company Notion used behind the scenes, and it ended with criminals holding copies of Notion AI chat transcripts from fewer than 1% of Notion workspaces. Notion began contacting affected customers on November 9, 2026, and on November 11 it revoked Notion API keys it found sitting inside affected users’ chat messages.

The short answer: if Notion has not emailed you or your workspace owner, Notion says it has not identified your workspace as affected and no action is needed right now. But this story is bigger than one app. Anything your staff types into an AI chat box, in any product, can end up stored by a company you have never heard of. If anyone on your team pasted a password, an API key, client details or financial information into Notion AI, treat it as exposed and change it today. Then put a simple AI rule in writing so it does not happen again.

I’m Steve Shaff, and I run PDX Information Technology Services out of Tualatin. Here’s what happened, in plain English, and the checklist I’d walk through with any Portland or Vancouver small business this week.

What happened in the Notion data breach

Here is the timeline from Notion’s own security advisory, as updated November 12, 2026:

What was in that dataset? Notion says it included Notion AI chat transcripts used for the Insights feature, a tool that helps workspace admins understand how their teams use AI. TechCrunch reported that, per Notion, the transcripts include “any input to or output from the model that was written to the chat.”

Notion also says that for the vast majority of affected workspaces, those transcripts were “unattributable.” In Notion’s words, the chats weren’t labeled with who wrote them or which workspace they came from, and they did not contain tool call results. No other Notion features were affected, according to the company. Notion has disabled Insights while it investigates and has stopped serving open-weight AI models through Fireworks.

That “unattributable” part is good news, but it is not a free pass. If someone typed “Here is the login for our QuickBooks, the password is…” into an AI chat, the chat itself tells a criminal what the password is for. The label does not matter when the content explains itself.

How the attackers got in: the Fireworks AI breach

Fireworks AI is a platform developers use to run open AI models. The Record reported on November 10 that Fireworks disclosed two incidents in October:

• October 6: Fireworks discovered a breach in which a financially motivated cybercriminal group stole account and billing information plus “secrets,” the digital keys that let people and apps access systems. Fireworks said a limited number of customer accounts were affected and notified.
• October 23 and 24: a third-party cloud provider that hosted Fireworks research machines was attacked. Fireworks said the attackers used that provider to reach Fireworks development machines and run an unauthorized workload, which led to additional customer data impact, including billing information, invoices, payment history and datasets.

TechCrunch reported that Fireworks believes the attackers are financially motivated and focused on selling stolen access to large language models. Fireworks has also linked its incidents to a wider pattern Google’s threat intelligence team and Mandiant call LLMjacking: criminals hijack a company’s access to AI models and resell it, leaving the victim with the bill. According to The Record, Mandiant observed fraudulent charges above $100,000 in a single day in some incidents.

So the chain looks like this: a cloud provider gets hit, which exposes an AI vendor, which exposes data from a company you actually signed up with. That is three companies deep. Most small business owners have no idea that chain exists.

Why a Portland small business should care

You might think, “We use Notion for meeting notes and a project board. Who cares?” Here is why I care, and why you should.

1. AI chat boxes collect your most sensitive text

People paste things into AI chats they would never put in an email: draft contracts, customer complaints with names and phone numbers, HR problems, pricing strategy, and yes, passwords and API keys. Notion found enough API keys in affected chats that it revoked them itself. That tells you how common the habit is.

2. “Zero data retention” has fine print

VentureBeat reported that Fireworks says it does not retain data by default for its main inference service, but some features do store customer content, such as stored responses, batch jobs and training. The breach reached the stored side. When a vendor tells you “we don’t keep your data,” ask: which features, on which plan, and who else is in the chain?

3. Breach news brings scam email

Every time a well-known brand has a breach, scammers send fake “security notice” emails to its users. Expect fake Notion emails asking you to “verify your workspace” or “download your exposed transcripts” through a link. Notion says affected customers can review the impacted data inside their own workspace, with instructions sent by email. The safe habit is simple: never sign in from an email link. Open Notion the way you always do and look there.

4. Stolen secrets get sold

Keys, passwords and access tokens are exactly what ends up for sale on the dark web. Once a working key is listed, it can be used to run up charges, read your files or get into connected apps. I covered how that resale market works in our guide to dark web scanning for Portland small businesses, and how one leaked password snowballs in credential stuffing explained.

Your Notion data breach checklist: what to do this week

Work through this in order. Most small teams can finish it in one afternoon.

Step 1: Find out if you were notified

• ☐ Ask whoever owns your Notion workspace (often the owner or office manager) to search their inbox for an email from Notion about the Fireworks incident.
• ☐ Check spam and junk folders too.
• ☐ If there is no notice, Notion says your workspace has not been identified as affected. Keep an eye on the Notion advisory page for updates.
• ☐ Do not click links in any “Notion security” email you weren’t expecting. Go to notion.so or the Notion app directly.

Step 2: If you were affected, review the exposed chats

• ☐ Follow Notion’s emailed instructions from inside your workspace to retrieve and review the impacted transcripts.
• ☐ Read them with one question in mind: “What in here would hurt us if a stranger had it?”
• ☐ List every password, API key, token, bank detail, client name or health or financial detail you find.

Step 3: Rotate anything that was ever pasted into an AI chat

• ☐ Change every password found in the transcripts, starting with email, banking, payroll and accounting.
• ☐ Revoke and reissue API keys and tokens (Notion integrations, Stripe, QuickBooks connections, cloud services, website plugins).
• ☐ Even if you were not notified, ask staff: “Have you ever pasted a password or key into any AI tool?” Rotate those too. This costs nothing and closes the door.
• ☐ Turn on multi-factor authentication for Notion and every account you just changed.

Step 4: Watch for follow-up scams

• ☐ Send your team a two-line heads-up: “Expect fake Notion security emails. Never sign in from a link; open the app directly and ask me if unsure.”
• ☐ Treat any urgent request to change bank details, pay an invoice or share a login as suspicious until verified by phone using a number you already have.
• ☐ Use email security that flags look-alike senders and impersonation. We use INKY for this.

Step 5: Check your AI bills and usage

• ☐ Because these attacks are tied to LLMjacking, review billing for any AI or cloud service with an API key: OpenAI, Anthropic, Azure, Google Cloud, AWS.
• ☐ Set spending limits and billing alerts so a stolen key can’t run up a surprise bill.
• ☐ Delete keys nobody uses anymore.

Step 6: Write (or update) your AI acceptable use rule

• ☐ One page is enough. Spell out what is never allowed in any AI tool: passwords, API keys, full card or bank numbers, Social Security numbers, health information, and client confidential data.
• ☐ List the AI tools the business approves, and who signs off on new ones.
• ☐ Teach people to use placeholders: “Client A” instead of the real name, “[PASSWORD]” instead of the password.

If you want a starting point, read Shadow AI in small business: how to find it and fix it. It walks through finding the AI tools your team already uses without telling you.

Step 7: Map your AI vendor chain

• ☐ For each AI feature your team relies on (Notion AI, Microsoft Copilot, meeting notetakers, chatbots), ask the vendor: which subprocessors handle our data, what is stored, and for how long?
• ☐ Check whether your plan includes stronger data protections and whether they are actually turned on.
• ☐ Keep the answers in one shared document so you can act fast the next time a vendor shows up in the news.

Our post on third-party portal risk for small businesses covers the same supplier-path problem from a banking angle, and AI meeting notetakers for small business shows how to set up recording tools without leaking client conversations.

The bigger lesson: your data lives in other people’s systems

This is the third vendor-chain story we have written about in a few weeks. The DreamHost data breach hit through a hosting provider, and the Amadeus data breach hit airline passengers through a booking system most travelers never see. Now Notion customers were exposed through an AI vendor sitting behind Notion.

Here is my honest take. You cannot audit every vendor’s vendor. Nobody can. What you can control is:

1. What you put in. If the secret never goes into the chat, it can’t leak from the chat.
2. How fast you find out. Monitoring tells you when your company’s emails and passwords show up in breach dumps, often before a criminal uses them.
3. How fast you can change things. A password manager, MFA everywhere and a short list of who owns which account turn a scary afternoon into a routine one.

If your business email does show up in a leak, follow our step-by-step plan: Your business email showed up in a data breach: what to do next. And because stolen session cookies can get around MFA, read how infostealer malware bypasses MFA too.

How PDX IT helps with AI and vendor breaches

At PDX Information Technology Services, we help small businesses in Portland, Tualatin, Beaverton, Lake Oswego and Vancouver, WA use AI without handing their secrets to strangers.

• Dark web monitoring is included in both our Gold and Platinum plans. We watch for your company’s email addresses and credentials in breach data and tell you what to change.
• Email security with INKY helps catch the fake “security notice” emails that always follow a big breach.
• AI implementation and AI policy work helps you choose approved tools, turn on the right data settings and train your team on what never goes into a chat.
• Platinum also includes SaaS Protect, which backs up your SharePoint and OneDrive data, so a bad day in the cloud doesn’t become a lost-files day.
• Our managed plans come with a 90-day opt-out, so you can see how we work before you commit long term.

Learn more on our cybersecurity services page and our managed IT services page.

FAQ: Notion data breach

Was my Notion account affected by the Notion data breach?

Notion says fewer than 1% of workspaces were affected and that it contacted affected customers starting November 9, 2026. If neither you nor your workspace owner received a notice, Notion says it has not identified your workspace as affected and no action is needed right now.

What data was exposed in the Notion data breach?

Notion says the exposed dataset included Notion AI chat transcripts used for its Insights feature. For most affected workspaces the chats were unattributable, meaning they weren’t labeled with the user or workspace and didn’t include tool call results. Notion says no other features were affected.

Was Notion itself hacked?

No. Notion says it was not a breach of its own systems. The data was taken from Fireworks AI, an AI infrastructure vendor Notion used for its Insights feature and to serve some open-weight models. Fireworks said attackers reached its development machines through a third-party cloud provider.

Should I change my passwords after the Notion data breach?

If anyone on your team pasted passwords, API keys or other credentials into Notion AI, change or revoke them now, whether or not you were notified. Notion recommends that affected customers rotate any credentials entered during the incident window. Turn on MFA for Notion and those accounts too.

Is it safe to keep using AI tools like Notion AI at work?

Yes, with rules. Keep passwords, keys, card numbers, health details and client confidential data out of every AI chat, use only approved tools, and check what each vendor stores. A one-page AI acceptable use policy and staff training cover most of the risk.

How can I tell if my business credentials are on the dark web?

Dark web monitoring watches breach dumps and criminal markets for your company’s email addresses and passwords. PDX IT includes dark web monitoring in our Gold and Platinum plans, and we tell you exactly what to change when something turns up.

Want a second set of eyes on your AI and vendor risk?

If the Notion data breach has you wondering what your team has been typing into AI tools, or which vendors are holding your data, let’s talk. We’ll help you sort out what needs changing and what can wait.

Reach out through our contact page, email sales@pdxittech.com, or call 971-331-4871.