Mixpanel Security Incident: What OpenAI Users Need to Know

A security incident within the systems of Mixpanel, a data analytics provider, resulted in a data leak affecting OpenAI API users and some ChatGPT users. This incident was not an intrusion into OpenAI's own systems, but rather an issue that occurred within the systems of Mixpanel, an external analytics tool.

The leaked information is limited to the following:

• Name and email address
• Approximate browser-based location (city, state, country)
• Operating system (OS) and browser in use
• Referring website and account-related organization/user ID

Chat content, API request data, passwords, API keys, and payment information were not exposed in this incident.

Upon becoming aware of the incident, OpenAI immediately removed Mixpanel from its production services and ended its partnership with the company. It is also expanding security reviews across its entire vendor ecosystem and strengthening security requirements.

Users should be cautious of phishing or social engineering attacks that could arise from the exposure of names and emails. OpenAI recommends trusting only messages sent through official domains and enabling multi-factor authentication (MFA).