InfoSecBulletin Cybersecurity for mankind
OpenAI has revealed a data breach involving Mixpanel, a third-party analytics provider that was used to monitor API platform usage. The breach exposed limited but sensitive user information, including names, email addresses, operating system details, and browser metadata.
OpenAI stated that the incident came from Mixpanel’s infrastructure and did not involve any attack on OpenAI’s systems. On November 9, 2025, Mixpanel found unauthorized access and discovered an attacker had exported customer data.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Mixpanel notified OpenAI about the breach and, by November 25, 2025, shared the specific dataset affected. Data affected was only from OpenAI’s API users through the platform.openai.com interface. ChatGPT and other OpenAI services were not impacted.
After Mixpanel’s notification, OpenAI quickly removed all Mixpanel analytics integrations from its services and reviewed the impacted datasets. The company is collaborating with Mixpanel to fully evaluate the breach and is informing all affected organizations, admins, and users.
OpenAI advises users to be alert for phishing or social engineering attacks because of the exposed data. If you get an unexpected email or message, you should:
Treat unexpected emails or messages with caution, especially if they include links or attachments.
Double-check that any message claiming to be from OpenAI is sent from an official OpenAI domain.
OpenAI does not request passwords, API keys, or verification codes through email, text, or chat.
Further protect your account by enabling multi-factor authentication (opens in a new window).
The incident highlights the risks of third-party service providers and the need for ongoing security reviews and strong vendor management to protect user data.
