Breachesby GlyphOpenAI
Disclosed Jan 30, 2024Unverified
Hijacked ChatGPT account exposed strangers' chats containing portal passwords
An Ars Technica reader found other people's ChatGPT conversations in his history, including usernames and passwords for a pharmacy prescription portal's support system; OpenAI said his account had been taken over and used from Sri Lanka as part of a pool distributing free access.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Jan 30, 2024 |
| Attack | Not stated |
| Data exposed | Prompts and chatsCredentials and tokens |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at OpenAI
Researchers used Claude to chain bugs and take over OpenAI employee ChatGPT accountsHacking exposed credentials and tokens, prompts and chats and internal documents.HackingAIUSUnverifiedSep 17TanStack npm supply chain attack reached two OpenAI employee devices and internal reposSupply chain exposed credentials and tokens and source code.Supply chainAIUSUnverifiedMay 14Mixpanel analytics vendor breach exposed limited data on OpenAI API usersVendor breach exposed names, emails and location data.Vendor breachAIUSUnverifiedNov 26, 2025Shared ChatGPT conversations were indexed by Google and other search enginesExposed data exposed prompts and chats and messages.Exposed dataAIUSUnverifiedJul 31, 2025Artists leaked early access to OpenAI's Sora video model on Hugging FaceInsider exposed API keys.InsiderAIUSUnverifiedNov 26, 2024Hacker accessed OpenAI internal employee discussion forum in 2023Hacking exposed messages and internal documents.HackingAIUSUnverifiedJul 5, 2024ChatGPT Redis bug exposed chat titles and Plus subscriber payment detailsExposed data exposed names, emails, addresses, payment cards and prompts and chats.Exposed dataAIUSMar 24, 2023
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.