Skip to content
Breaches.

OpenAI

Disclosed May 14, 20264 months agoUnverified

TanStack npm supply chain attack reached two OpenAI employee devices and internal repos

OpenAI said two employees' devices were compromised in the Mini Shai-Hulud supply chain campaign attributed to TeamPCP, with credential-focused exfiltration from a limited set of internal source repositories. It rotated code-signing certificates and said customer data and production systems were not affected.

What is known

People affectedNot stated in the sources we have
DisclosedMay 14, 2026
AttackSupply chain
Data exposedCredentials and tokens, Source code
SectorAI · US
StatusUnverified: not yet confirmed by an official notice, a filing or the organization
Part ofTanstack (2026)

Sources

Source
OpenAI says hackers stole some data after latest code security issuetechcrunch.com · News
OpenAI confirms security breach in TanStack supply chain attackbleepingcomputer.com · News

Notices filed

WhereFiledPeople
ResearchtotalMay 14
ResearchtotalMay 14

Same campaign

OrganizationAffected
GitHubGitHub says 3,800 internal repositories stolen via poisoned Nx Console extensionMay 204 months agoSupply chainUnknown
Grafana LabsGrafana Labs says stolen GitHub token let hackers take its source codeMay 164 months agoSupply chainUnverifiedUnknown
Mistral AITeamPCP offers Mistral AI code repos for sale after TanStack compromiseMay 144 months agoSupply chainUnknown

Other breaches at OpenAI

BreachAffected
Researchers used Claude to chain bugs and take over OpenAI employee ChatGPT accountsSep 178 days agoHackingUnverifiedUnknown
Mixpanel analytics vendor breach exposed limited data on OpenAI API usersNov 26, 202510 months agoVendor breachUnverifiedUnknown
Shared ChatGPT conversations were indexed by Google and other search enginesJul 31, 20251 year agoExposed dataUnverifiedUnknown
Artists leaked early access to OpenAI's Sora video model on Hugging FaceNov 26, 20241 year agoInsiderUnverifiedUnknown
Hacker accessed OpenAI internal employee discussion forum in 2023Jul 5, 20242 years agoHackingUnverifiedUnknown
Hijacked ChatGPT account exposed strangers' chats containing portal passwordsJan 30, 20242 years agoUnverifiedUnknown
ChatGPT Redis bug exposed chat titles and Plus subscriber payment detailsMar 24, 20233 years agoExposed dataUnknown
History of this record
  • 2026-09-25 · summary: OpenAI said two employee devices were compromised in the Mini Shai-Hulud TanStack npm supply-chain attack, exposing limited credentials from internal code repositories and code-signing certificates, which it rotated. It found no customer da to OpenAI said two employees' devices were compromised in the Mini Shai-Hulud supply chain campaign attributed to TeamPCP, with credential-focused exfiltration from a limited set of internal source repositories. It rotated code-signing certifi · seed source
  • 2026-09-25 · title: OpenAI says TanStack supply-chain attack hit employee devices and signing certs to TanStack npm supply chain attack reached two OpenAI employee devices and internal repos · seed source
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about OpenAI

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.