---
title: "Harvey, told of a second, more serious Fireworks hack, has yet to say whether law firm data was exposed"
description: "Fireworks' Monday bulletin put customer datasets and unfinished model weights in the exposed set, and The Information reported Harvey was among the customers told. Harvey's $15.5 billion private mark now rests on custody it has not publicly accounted for."
publisher: "The Inference"
section: "Security"
published: 2026-11-10T15:05:05.217Z
modified: 2026-11-10T15:05:05.217Z
canonical: https://theinference.org/article/harvey-told-of-a-second-more-serious-fireworks-hack-has-yet-to-say-whether-law-firm-data-was-exposed
language: en
keywords: "Security, Data Breaches, Legal Tech, AI Infrastructure, Venture Capital"
---

# Harvey, told of a second, more serious Fireworks hack, has yet to say whether law firm data was exposed

> Fireworks' Monday bulletin put customer datasets and unfinished model weights in the exposed set, and The Information reported Harvey was among the customers told. Harvey's $15.5 billion private mark now rests on custody it has not publicly accounted for.

[Fireworks AI](https://theinference.org/markets/companies/fireworks-ai), the [Nvidia](https://theinference.org/markets/companies/nvidia)-backed host that runs and fine-tunes models for more than 10,000 companies, disclosed its second breach in five weeks on Monday, and this one reached billing records, account secrets and, for some customers, incomplete model weights and datasets [1][2]. [The Information reported](https://mlq.ai/news/fireworks-ai-told-customers-including-harvey-of-a-second-more-serious-hack-the-information-reports/) that Fireworks told large customers, [Harvey](https://theinference.org/markets/companies/harvey) among them, that this hack was more serious than the October one; Harvey has not commented publicly [1].

No source has established that Harvey's data was taken, and Fireworks has not named affected customers [1]. So the question that moves money now sits with Harvey, whose $15.5 billion September mark assumes the custody promise held [3].

## The breached surfaces are where tuned models live

Fireworks' updated bulletin walks the route: a third-party cloud provider hosting its research machines had an incident on October 23, and the next day an unauthorized party used it to reach Fireworks' development machines and run an unauthorized workload [1][2]. For some customers that meant datasets and unfinished model weights, and Fireworks has [paused self-serve dataset uploads and downloads](https://www.unite.ai/fireworks-ai-expands-breach-disclosure-to-datasets-and-model-weights/) for batch inference and dataset-based training while it investigates [4].

That pause is the detail that matters. Batch datasets are where a customer's own documents become a tuned model, which is the work Harvey pays Fireworks to do [3][4]. The attackers, Fireworks says, were criminals reselling stolen model access, a trade Google and Mandiant researchers document at costs reaching $1 million before the access is cut [2].

## Harvey sells the vault, and the vault question just gained a subprocessor

Harvey's pitch to law firms and banks is the opposite arrangement: arbitration research arrives "at the matter itself," and Vault keeps documents inside Harvey's environment [5]. [Commercial Bank of Dubai signed only after putting the platform through its third-party risk assessment](https://news.nakoda.ai/article/commercial-bank-of-dubai-picks-harvey-legal-ai-in-house-lawyers) [6].

Every buyer of legal AI can now ask a sharper version of that question: which subprocessor holds what, and was any of it in Fireworks' exposed set? Addleshaw Goddard, which [hands Harvey to more than 3,400 lawyers and staff from January](https://www.unite.ai/addleshaw-goddard-to-deploy-harvey-firmwide-and-co-develop-legal-ai/), has a rollout to answer for before it starts [7][8].

## Price Harvey on its answer, not its September mark

Harvey raised $550 million in September at a $15.5 billion valuation on about $400 million of annual recurring revenue, short of the $500 million to $800 million legal tech companies usually bring to a public listing [9]. The unit economics were already thin; [our October piece found Harvey's gross margin below minus 50 percent](https://theinference.org/article/anthropic-s-reported-2-trillion-ipo-rests-on-customers-like-harvey-whose-gross-margin-fell-below-minus-50) [10].

Meanwhile the vendor holding its tuned models is telling customers their datasets and half-built weights were reachable while [asking investors for $30 billion to $40 billion](https://www.bloomberg.com/news/articles/2026-11-09/nvidia-backed-fireworks-ai-notifies-customers-of-its-second-hack-in-weeks), up from $17.5 billion in July [3]. Custody is a promise made about other people's machines, and this week showed how far the chain runs before it reaches a lawyer's desk. Until Harvey says whether any of its fine-tuning or batch work sat on the affected Fireworks surfaces, and whether firms like Addleshaw have been told, the September number is not a valuation. It is a placeholder pending disclosure.

*Chart: **Harvey's September mark was already below its July round; the next raise asks $30 billion to $40 billion** Line chart of Harvey's private valuation: $17.5 billion at its July 2026 round, $15.5 billion at its September round, and a reported $30 billion to $40 billion ask for the next raise*

*Post-money valuation at Harvey's July 2026 round ($17.5 billion) and September 2026 round ($15.5 billion); the final point is the $30 billion to $40 billion ask Bloomberg reported for its next raise, drawn at midpoint with the reported range. Sources: Bloomberg; Legal IT Insider. [3][9]*

## Takeaway

Fireworks' second breach in five weeks reached billing records, account secrets and, for some customers, datasets and unfinished model weights, and Harvey, its marquee legal customer, has not said whether its work sat on the exposed surfaces; the $15.5 billion private mark waits on that answer.

## Sources

1. [MLQ.ai, Fireworks AI confirms a second breach exposed customer billing data and some model weights, 9-10 November 2026](https://mlq.ai/news/fireworks-ai-told-customers-including-harvey-of-a-second-more-serious-hack-the-information-reports/)
2. [BleepingComputer, Fireworks AI discloses new breach after cloud provider hack, 10 November 2026](https://www.bleepingcomputer.com/news/security/fireworks-ai-discloses-new-breach-after-cloud-provider-hack/)
3. [Bloomberg, Nvidia-Backed Fireworks AI Notifies Customers of Its Second Hack in Weeks, 9 November 2026](https://www.bloomberg.com/news/articles/2026-11-09/nvidia-backed-fireworks-ai-notifies-customers-of-its-second-hack-in-weeks)
4. [Unite.AI, Fireworks AI Expands Breach Disclosure to Datasets and Model Weights, 9 November 2026](https://www.unite.ai/fireworks-ai-expands-breach-disclosure-to-datasets-and-model-weights/)
5. [Agente Lex, Harvey and Jus Mundi announce agent-to-agent alliance, 9 November 2026](https://agentelex.es/en/legaltech-ai-startups/harvey-jus-mundi-agent-to-agent-alliance-arbitration/)
6. [Nakoda News, Commercial Bank of Dubai Picks Harvey's Legal AI for Its In-House Lawyers, 7 November 2026](https://news.nakoda.ai/article/commercial-bank-of-dubai-picks-harvey-legal-ai-in-house-lawyers)
7. [Unite.AI, Addleshaw Goddard to Deploy Harvey Firmwide and Co-Develop Legal AI, 9 November 2026](https://www.unite.ai/addleshaw-goddard-to-deploy-harvey-firmwide-and-co-develop-legal-ai/)
8. [Law360, Addleshaw Goddard, Harvey Partner On Firmwide AI Adoption, 9 November 2026](https://www.law360.com/pulse/articles/2547781/addleshaw-goddard-harvey-partner-on-firmwide-ai-adoption)
9. [Legal IT Insider, Harvey IPO: The question isn't really if it wants to float, but should it?, 9 November 2026](https://legaltechnology.com/harvey-ipo-the-question-isnt-really-if-it-wants-to-float-but-should-it/)
10. [The Inference, Anthropic's reported $2 trillion IPO rests on customers like Harvey, whose gross margin fell below minus 50%, 24 October 2026](/article/anthropic-s-reported-2-trillion-ipo-rests-on-customers-like-harvey-whose-gross-margin-fell-below-minus-50)


---

Harvey, told of a second, more serious Fireworks hack, has yet to say whether law firm data was exposed — The Inference. Canonical: https://theinference.org/article/harvey-told-of-a-second-more-serious-fireworks-hack-has-yet-to-say-whether-law-firm-data-was-exposed