Breachesby GlyphOpenAI
Disclosed Nov 26, 2025Unverified
Mixpanel analytics vendor breach exposed limited data on OpenAI API users
An SMS phishing attack on analytics provider Mixpanel exposed data OpenAI had sent it about some API platform users, including names, emails, coarse location, browser and OS details and org or user IDs. OpenAI said chats, API keys, passwords and payment details were not affected and stopped using Mixpanel.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Nov 26, 2025 |
| Discovered | Nov 8, 2025 |
| Attack | Vendor breach |
| Data exposed | NamesEmailsLocationOther |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at OpenAI
Researchers used Claude to chain bugs and take over OpenAI employee ChatGPT accountsHacking exposed credentials and tokens, prompts and chats and internal documents.HackingAIUSUnverifiedSep 17TanStack npm supply chain attack reached two OpenAI employee devices and internal reposSupply chain exposed credentials and tokens and source code.Supply chainAIUSUnverifiedMay 14Shared ChatGPT conversations were indexed by Google and other search enginesExposed data exposed prompts and chats and messages.Exposed dataAIUSUnverifiedJul 31, 2025Artists leaked early access to OpenAI's Sora video model on Hugging FaceInsider exposed API keys.InsiderAIUSUnverifiedNov 26, 2024Hacker accessed OpenAI internal employee discussion forum in 2023Hacking exposed messages and internal documents.HackingAIUSUnverifiedJul 5, 2024Hijacked ChatGPT account exposed strangers' chats containing portal passwordsExposed prompts and chats and credentials and tokens.AIUSUnverifiedJan 30, 2024ChatGPT Redis bug exposed chat titles and Plus subscriber payment detailsExposed data exposed names, emails, addresses, payment cards and prompts and chats.Exposed dataAIUSMar 24, 2023
History of this record
empty to 2025-11-08by seedSource
OpenAI said an attacker who breached its analytics vendor Mixpanel exported data on some OpenAI API platform users, including names, emails, approximate location and browser details; chat content, API keys and payment data were not affected to An SMS phishing attack on analytics provider Mixpanel exposed data OpenAI had sent it about some API platform users, including names, emails, coarse location, browser and OS details and org or user IDs. OpenAI said chats, API keys, passwordby seedSource
OpenAI API users' names and emails exposed in Mixpanel breach to Mixpanel analytics vendor breach exposed limited data on OpenAI API usersby seedSource
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.