Mixpanel Breach Exposes Limited OpenAI API User Analytics Data
Published on November 28, 2025
Key Takeaways
- Third-party breach: The security incident occurred within Mixpanel's systems, a third-party analytics provider, not within OpenAI's infrastructure.
- Limited data exposure: The breach exposed analytics data for some users of OpenAI's API platform, including sensitive information.
- No core data compromised: OpenAI confirms that no chat content, API keys, passwords, or payment details were accessed or exposed.
OpenAI has disclosed a security incident originating with its former third-party analytics vendor, Mixpanel, that exposed limited data for some users of its API platform. On November 9, 2025, Mixpanel identified unauthorized access to its environment, resulting in the export of a dataset containing customer information.
Was OpenAI Breached?
No, the company said this was not a breach of OpenAI's own systems. Users of ChatGPT and other consumer-facing OpenAI products were not affected by this Mixpanel analytics data breach.
OpenAI Mixpanel Security Incident: Scope and Cause
The incident was caused by a smishing campaign (SMS phishing) targeting Mixpanel, as confirmed by Mixpanel's official statement. On November 9, 2025, Mixpanel identified unauthorized access to its environment, resulting in the export of a dataset containing customer information.
The compromised information was limited to user profile and analytics data associated with the use of ‘platform.openai.com.’ According to OpenAI's disclosure, the exposed dataset may have included:
- names,
- email addresses,
- approximate coarse location (city, state, country),
- operating system,
- browser details,
- organization or user IDs.
The exposed API user data was limited to metadata collected by Mixpanel for frontend web analytics. Critically, no sensitive information such as chat content, API requests, API usage data, passwords, credentials, API keys, or payment details was compromised.
OpenAI's Response and User Precautions
In response to the Mixpanel security breach, OpenAI has terminated its use of Mixpanel's services and removed the tool from its production environment. The company said it is conducting expanded security reviews across its entire vendor ecosystem and is directly notifying all affected organizations and users.
While credentials were not affected, OpenAI advises users to remain vigilant against phishing or social engineering attempts that could exploit the exposed information and to enable multi-factor authentication (MFA) to further secure their accounts.
In other recent news, the malicious AI WormGPT 4 emerged as a powerful tool for cybercrime, with subscriptions starting at $50, and Canon confirmed a U.S. subsidiary breach as part of the Cl0p Oracle EBS hack campaign.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular