Hackers claim 110M Notion records exposed, but the company’s AI assistant is not concerned
A hacker has claimed responsibility for a massive breach of Notion – a productivity platform used by Nvidia and OpenAI – exposing 110 million user records. Meanwhile the company says that no unauthorized access was identified.
A hacker has claimed responsibility for a massive breach of Notion – a productivity platform used by Nvidia and OpenAI – exposing 110 million user records. Meanwhile the company says that no unauthorized access was identified.
- A hacker claims to have stolen and is selling 110 million Notion user records.
- The leaked data reportedly includes email addresses, password hashes, login metadata, and workspace details.
- Notion has not confirmed the alleged breach, with the company's AI customer support assistant responding only with general security practices rather than addressing the specific claim.
- If proven to be legitimate, the leak increases the risk of account takeovers, credential stuffing, and phishing attacks.
A threat actor has taken to underground forums to claim responsibility for a data breach at the popular productivity platform Notion. The attacker is offering more than 110 million user records, containing account information, password hashes, and login metadata, to the highest bidder.
To support the claim, the seller published 48 sample records. Cybernews researchers have reviewed the samples and found they include a wide range of account-related information, including:
- Email addresses
- Email verification status
- Usernames
- Password hashes
- Signup IP addresses
- Last login IP addresses
- Account creation timestamps
- Last activity timestamps
- Locale, timezone, and country information
- Workspace names and user roles
- Subscription and trial status
Our researchers note that the sample appears internally consistent. However, they stress that there is currently no way to verify whether the full dataset actually contains the advertised 110 million records.
"The sample looks legitimate, but we cannot confirm the claimed number of records," they said.
Notion states that it has over 100 million users across its applications. Among the high-profile clients using the company’s productivity apps are Nvidia, OpenAI, Toyota, and Vercel.
Users are at risk of account takeovers
While the allegedly stolen passwords appear to be stored as hashes rather than plaintext, our researchers warn that they still present security risks.
"The main concerns are account takeovers and credential stuffing because password hashes are included," they explained.
Depending on the hashing algorithm and password strength, attackers may attempt to crack some hashes. If successful, the recovered passwords could be tested against other online services. As many users have a vicious habit of reusing passwords, this may pose risks to various accounts.
Attackers could also use exposed email addresses for phishing campaigns impersonating Notion support or other trusted services.
The researchers warn that attackers frequently combine leaked account information with previously stolen credentials to create more convincing social engineering attacks.
Breach reporting may not pass the gatekeeper – the company’s AI assistant
Cybernews reached out to the company for confirmation. However, instead of receiving a response from a spokesperson or security team, the inquiry was answered by the company's AI-powered customer support assistant.
The automated reply stated it "cannot confirm a specific cyber incident from the information provided," before outlining Notion's general security practices. Checking posts on hacker forums is clearly beneath the scope of the AI assistant that the company uses.
The AI assistant stated that instead of commenting on breach claims, it can give more details about the company's security measures.
“What I can share is how Notion handles security incidents and customer communication.”
According to AI’s response, Notion:
- The company has a 24/7 incident response
- Uses AES-256 encryption for data at rest, TLS 1.2 or higher for data in transit
- Enforces multi-factor authentication for employees
- Performs daily backups
- Says it would notify customers within 72 hours of a confirmed breach where required by law
It is not the first time Notion has been caught in a cybersecurity incident. In April this year, security researchers identified privacy issues in Notion’s systems that may have contributed to a data leak.
According to cybersecurity experts, the pages that users openly publish on the internet may be leaking personal information of those who have edited them, including usernames, profile images, and even email addresses associated with the accounts.
every public Notion page is leaking the email addresses of everyone who edited it.
undefined impulsive (@weezerOSINT) April 19, 2026
zero authentication. no cookies. no tokens. one POST request returns full names, emails, and profile photos for every editor on the page.
your company wiki is public? every employee's email is… pic.twitter.com/jqWSCVBoyH
Notion denies the breach
After this publication went live, Notion contacted Cybernews regarding the hacker claims. The company stated that there was no unauthorized access to their systems.
"We've found no credible evidence of unauthorized access to or a breach of Notion's systems. Based on our security team's investigation to date, this allegation is not legitimate,” the company's spokesperson said.
Updated on June 30th [10:30 a.m. GMT+2] with a statement from Notion.
Unlock more exclusive Cybernews content on YouTube.