What happened
A security breach at Mixpanel, a third-party analytics provider for OpenAIâs API frontend, exposed limited user data including names and email addresses. The breach occurred within Mixpanelâs systems, not OpenAIâs infrastructure, and an attacker exported a dataset containing identifiable OpenAI API user information. OpenAI was notified on November 9, 2025, and received the affected dataset on November 25, enabling it to start an investigation. The incident did not compromise passwords, API keys, or other sensitive OpenAI user data.
Why it matters
- The exposed data could be used in phishing or social engineering attacks targeting OpenAI API users or their organizations.
- The breach highlights risks associated with third-party vendor security in handling user data.
- OpenAI is increasing security requirements for all third-party partners and conducting expanded security reviews.
Key facts
- 1. The Mixpanel breach was detected on November 9, 2025.
- 2. Mixpanel shared the affected dataset with OpenAI on November 25, 2025.
- 3. Exposed data included names, email addresses, coarse location data, operating system, browser information, and organization or user IDs linked to API accounts.
- 4. No OpenAI core systems were breached; passwords, API keys, chat content, payment details, and government IDs remained secure.
- 5. The breach affected only users of OpenAIâs API frontend (platform.openai.com), not ChatGPT or other consumer products.
Key Voices
- OpenAI confirmed the breach was limited to Mixpanelâs systems and emphasized no core OpenAI systems or sensitive user credentials were compromised.
- OpenAI urged users not to reset passwords or rotate API keys but to contact support for any concerns.
- Mixpanel detected the unauthorized intrusion and promptly notified OpenAI, sharing the affected dataset for investigation.
- Not stated in the article.
