InfoSecBulletin Cybersecurity for mankind
OpenAI has revealed a data breach involving Mixpanel, a third-party analytics provider that was used to monitor API platform usage. The breach exposed limited but sensitive user information, including names, email addresses, operating system details, and browser metadata.
OpenAI stated that the incident came from Mixpanel’s infrastructure and did not involve any attack on OpenAI’s systems. On November 9, 2025, Mixpanel found unauthorized access and discovered an attacker had exported customer data.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
Mixpanel notified OpenAI about the breach and, by November 25, 2025, shared the specific dataset affected. Data affected was only from OpenAI’s API users through the platform.openai.com interface. ChatGPT and other OpenAI services were not impacted.
After Mixpanel’s notification, OpenAI quickly removed all Mixpanel analytics integrations from its services and reviewed the impacted datasets. The company is collaborating with Mixpanel to fully evaluate the breach and is informing all affected organizations, admins, and users.
OpenAI advises users to be alert for phishing or social engineering attacks because of the exposed data. If you get an unexpected email or message, you should:
Treat unexpected emails or messages with caution, especially if they include links or attachments.
Double-check that any message claiming to be from OpenAI is sent from an official OpenAI domain.
OpenAI does not request passwords, API keys, or verification codes through email, text, or chat.
Further protect your account by enabling multi-factor authentication (opens in a new window).
The incident highlights the risks of third-party service providers and the need for ongoing security reviews and strong vendor management to protect user data.
