LmCast :: Stay tuned in

OpenAI discloses API customer data breach via Mixpanel vendor hack

Recorded: Nov. 27, 2025, 1:02 p.m.

Original Summarized

OpenAI discloses API customer data breach via Mixpanel vendor hack

News

Featured
Latest

The Black Friday 2025 Cybersecurity, IT, VPN, & Antivirus Deals

Microsoft to secure Entra ID sign-ins from script injection attacks

New ShadowV2 botnet malware used AWS outage as a test opportunity

Microsoft: Windows 11 24H2 bug crashes Explorer and Start Menu

Unlock lifelong access to documentaries on MagellanTV for $140

OpenAI discloses API customer data breach via Mixpanel vendor hack

New ShadowV2 botnet malware used AWS outage as a test opportunity

NordVPN Black Friday Deal: Unlock 77% off VPN plans in 2025

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Virus Removal Guides

Latest
Most Viewed
Ransomware

Remove the Theonlinesearch.com Search Redirect

Remove the Smartwebfinder.com Search Redirect

How to remove the PBlock+ adware browser extension

Remove the Toksearches.xyz Search Redirect

Remove Security Tool and SecurityTool (Uninstall Guide)

How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo

How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller

How to remove Antivirus 2009 (Uninstall Instructions)

Locky Ransomware Information, Help Guide, and FAQ

CryptoLocker Ransomware Information Guide and FAQ

CryptorBit and HowDecrypt Information Guide and FAQ

CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ

Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Startup Database
Uninstall Database
Glossary
Chat on Discord
Send us a Tip!
Welcome Guide

HomeNewsSecurityOpenAI discloses API customer data breach via Mixpanel vendor hack

 

OpenAI discloses API customer data breach via Mixpanel vendor hack

By Ionut Ilascu

November 27, 2025
06:27 AM
0

OpenAI is notifying some ChatGPT API customers that limited identifying information was exposed following a breach at its third-party analytics provider Mixpanel.
Mixpanel offers event analytics that OpenAI uses to track user interactions on the frontend interface for the API product.
According to the AI company, the cyber incident affected “limited analytics data related to some users of the API” and did not impact users of ChatGPT or other products.

“This was not a breach of OpenAI’s systems. No chat, API requests, API usage data, passwords, credentials, API keys, payment details, or government IDs were compromised or exposed,” OpenAI says in a press release.
Mixpanel reported that the attack “impacted a limited number of our customers” and resulted from a smishing (SMS phishing) campaign that the company detected on November 8.
OpenAI received details of the affected dataset on November 25 after being informed of Mixpanel’s ongoing investigation.
The AI company notes that the exposed information may include:
Name that was provided to us on the API account
Email address associated with the API account
Approximate coarse location based on API user browser (city, state, country)
Operating system and browser used to access the API account
Referring websites
Organization or User IDs associated with the API account
Because no sensitive credentials were exposed, users do not need to reset passwords or regenerate API keys.
Some users are reporting that CoinTracker, a cryptocurrency portfolio tracker and tax platform, has also been impacted, with exposed data also including device metadata and limited transaction count.
OpenAI has started an investigation to determine the full scope of the incident. As a precaution, it has removed Mixpanel from its production services and is notifying organizations, administrators, and individual users directly.
While OpenAI underlines that only users of its API are impacted, it notified all its subscribers.
The company warns that the leaked data could be leveraged in phishing or social-engineering attacks and advises users to watch for credible-looking malicious messages related to the incident.
Messages containing links or attachments should be verified to ensure they originate from an official OpenAI domain.
The company also urges users to enable 2FA and never send sensitive information, including passwords, API keys, or verification codes, through email, text, or chat.
Mixpanel’s CEO, Jen Taylor, said that all impacted customers have been contacted directly. “If you have not heard from us, you were not impacted,” she noted.
In response to the attack, Mixpanel secured affected accounts, revoked active sessions and sign-ins, rotated compromised credentials, blocked the threat actor’s IP addresses, and reset passwords for all employees. The company has also implemented new controls to prevent similar incidents in the future.

7 Security Best Practices for MCP
As MCP (Model Context Protocol) becomes the standard for connecting LLMs to tools and data, security teams are moving fast to keep these new services safe.
This free cheat sheet outlines 7 best practices you can start using today.
Download Now

Ionut Ilascu
Ionut Ilascu is a technology writer with a focus on all things cybersecurity. The topics he writes about include malware, vulnerabilities, exploits and security defenses, as well as research and innovation in information security. His work has been published by Bitdefender, Netgear, The Security Ledger and Softpedia.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

Popular Stories

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

Microsoft to remove WINS support after Windows Server 2025

Microsoft: Exchange Online outage blocks access to Outlook mailboxes

Sponsor Posts

Worried about finance scams? Get Avast Free Antivirus with intelligent online scam detection

WSUS can’t keep up in a remote-first world. Cloud-native patching fixes what VPNs never could

CMMC Made Simple. Get audit-ready with Huntress—faster, easier, and more affordable.

Empowering IT teams with intelligence‑driven cyber threat research

Overdue a password health-check? Audit your Active Directory for free

Review of Passwork: Affordable Enterprise-Grade Password Manager

  Upcoming Webinar

Follow us:

Main Sections

News
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

OpenAI has disclosed a data breach impacting a subset of its ChatGPT API customers, stemming from a vulnerability within its third-party analytics provider, Mixpanel. The incident, initially detected on November 8th, involved a smishing campaign and resulted in the exposure of limited identifying information for users interacting with the API. Specifically, the data compromised included the user’s name, associated email address, approximate location based on browser data (city, state, and country), operating system, browser, referring websites, and organization or user IDs linked to the API account. CoinTracker, a cryptocurrency portfolio tracking platform, was also implicated in the breach, with additional data comprising device metadata and limited transaction counts.

Notably, no sensitive credentials such as API keys, passwords, or payment details were accessed, alleviating the immediate need for password resets or key regeneration for affected users. However, the potential for this exposed data to be exploited in phishing or social engineering attacks is a significant concern. OpenAI has taken swift action, including removing Mixpanel from its production services, investigating the full scope of the incident, and issuing notifications to all subscribers. As a preventative measure, Mixpanel has implemented stricter security controls, including securing affected accounts, revoking active sessions, rotating compromised credentials, blocking the threat actor’s IP addresses, and resetting passwords for all employees and has added new controls to prevent future breaches.

The company's CEO, Jen Taylor, emphasized that only those users directly interacting with the API were impacted and that individuals who haven’t received direct communication from Mixpanel were not involved. Despite this, OpenAI issued a broad warning to all subscribers, advising vigilance against suspicious messages originating from unofficial OpenAI domains, and urged users to enable two-factor authentication and never transmit sensitive information through email, text, or chat.

The breach highlights the interconnectedness of data ecosystems and the potential risks associated with relying on third-party vendors. The incident underscores the critical importance of stringent security protocols and continuous monitoring by organizations utilizing API services. The response by OpenAI demonstrates a commitment to mitigating the damage and preventing recurrence, including the implementation of extensive security measures within Mixpanel.

Moving forward, this incident necessitates a re-evaluation of risk management strategies for organizations dependent on API services, especially those requiring secure access to sensitive data. The vulnerability’s origin – a smishing campaign – emphasizes the evolving nature of cyber threats and the need for comprehensive user education regarding phishing attempts. OpenAI’s actions represent a foundational step in demonstrating accountability but will likely trigger further scrutiny and potentially impact user trust in the API platform. The event offers valuable insights for security professionals and underscores the necessity for robust vendor risk management practices in a landscape increasingly defined by complex technological integrations.