Notion securityJapanese firms say Notion AI chat leak included client and staff names
Several Japanese companies now say the Notion AI Notion's built-in AI assistant that can answer questions, write or edit pages, and take actions inside a workspace. chat leak through outside vendor Fireworks AI may have exposed client names, AI Meeting Notes A Notion tool that records a meeting and writes a transcript and summary. Notion also uses the name Notetaker for a wider version of this feature. and staff details, ITmedia AI+ reported on 12 November. It follows Notion's own notice of 9 November (US time), which we covered on 11 November.
What we learned
- Calendar app maker TimeTree said on 12 November that exposed chats included personal details of 99 people: 13 survey and interview participants, 5 client contacts and 81 executives and staff, plus some business information. It has reported the case to Japan's Privacy regulator A government body that enforces data protection laws and must be told about some leaks of personal information. and says no passwords were included.
- Security firms SecureNavi and LRM and agriculture firm Fager published notices on 11 November after hearing from Notion on 10 November. SecureNavi says client company names, contact names and the content of enquiries and meetings may be included; LRM says the affected chats were from 5 to 24 October.
- Notion's Japanese advisory says that on 11 November it Revoke To cancel a key, password or permission so it stops working, even if someone else has a copy. Notion API key A secret code that lets a program use a paid online service. Anyone who steals it can run up your bill. found inside affected users' messages. That shows some people did paste secrets into AI chats; keys and passwords for other services are not revoked automatically.
- All of these companies say their own systems were not broken into, and warn customers about scam emails or calls pretending to be them or Notion.
Why it matters: Notion says fewer than 1% of Workspace In Notion, a workspace is a team's shared space: the account that holds its pages, databases and members. were affected, but these notices show what leaked chat transcripts mean in practice: client names and meeting notes. If your workspace got Notion's email, check the chats and change any keys or passwords that were pasted into Notion AI.