Harvey, told of a second, more serious Fireworks hack, has yet to say whether law firm data was exposed

Fireworks AIPVT~$1.1B — Fireworks AI, private, latest valuation ~$1.1B, the Nvidia▼−4.65% — Nvidia, down 4.65 percent today-backed host that runs and fine-tunes models for more than 10,000 companies, disclosed its second breach in five weeks on Monday, and this one reached billing records, account secrets and, for some customers, incomplete model weights and datasets ¹². The Information reported↗ that Fireworks told large customers, HarveyPVT$15.5B — Harvey, private, latest valuation $15.5B among them, that this hack was more serious than the October one; Harvey has not commented publicly ¹.

No source has established that Harvey's data was taken, and Fireworks has not named affected customers ¹. So the question that moves money now sits with Harvey, whose $15.5 billion September mark assumes the custody promise held ³.

The breached surfaces are where tuned models live

Fireworks' updated bulletin walks the route: a third-party cloud provider hosting its research machines had an incident on October 23, and the next day an unauthorized party used it to reach Fireworks' development machines and run an unauthorized workload ¹². For some customers that meant datasets and unfinished model weights, and Fireworks has paused self-serve dataset uploads and downloads↗ for batch inference and dataset-based training while it investigates ⁴.

That pause is the detail that matters. Batch datasets are where a customer's own documents become a tuned model, which is the work Harvey pays Fireworks to do ³⁴. The attackers, Fireworks says, were criminals reselling stolen model access, a trade Google and Mandiant researchers document at costs reaching $1 million before the access is cut ².

Harvey sells the vault, and the vault question just gained a subprocessor

Harvey's pitch to law firms and banks is the opposite arrangement: arbitration research arrives "at the matter itself," and Vault keeps documents inside Harvey's environment ⁵. Commercial Bank of Dubai signed only after putting the platform through its third-party risk assessment↗ ⁶.

Every buyer of legal AI can now ask a sharper version of that question: which subprocessor holds what, and was any of it in Fireworks' exposed set? Addleshaw Goddard, which hands Harvey to more than 3,400 lawyers and staff from January↗, has a rollout to answer for before it starts ⁷⁸.

Price Harvey on its answer, not its September mark

Harvey raised $550 million in September at a $15.5 billion valuation on about $400 million of annual recurring revenue, short of the $500 million to $800 million legal tech companies usually bring to a public listing ⁹. The unit economics were already thin; our October piece found Harvey's gross margin below minus 50 percent ¹⁰.

Meanwhile the vendor holding its tuned models is telling customers their datasets and half-built weights were reachable while asking investors for $30 billion to $40 billion↗, up from $17.5 billion in July ³. Custody is a promise made about other people's machines, and this week showed how far the chain runs before it reaches a lawyer's desk. Until Harvey says whether any of its fine-tuning or batch work sat on the affected Fireworks surfaces, and whether firms like Addleshaw have been told, the September number is not a valuation. It is a placeholder pending disclosure.