OpenAI Discloses Data Breach at Analytics Partner Mixpanel

On November 9, 2025, an attacker gained unauthorized access to Mixpanel’s systems (the analytics platform formerly used by OpenAI) through a smishing (SMS phishing) campaign targeting a Mixpanel employee.

The intruder was able to export a limited dataset containing basic profile information of some OpenAI API users, including:

• Names
• Email addresses
• Approximate location data derived from browsers
• Device and browser information

Importantly, the exported data did not include API keys, passwords, ChatGPT conversation history, or any sensitive payment details.

OpenAI’s Response

After being notified by Mixpanel, OpenAI’s security team immediately reviewed the stolen dataset and confirmed there was no evidence of wider compromise to its own systems.

As a precaution, OpenAI has:

• Terminated its relationship with Mixpanel
• Removed all Mixpanel tracking code from its websites and services
• Begun migrating to alternative analytics providers

What This Means for Users

If you have ever used the OpenAI API, there’s a small chance your name and email were included in the leaked dataset. While the exposed information is relatively low-sensitivity, it could potentially be used in targeted phishing attempts.

Bottom Line

No API keys or chat history were compromised, and OpenAI has already cut ties with the affected vendor. Still, it’s another reminder to enable multi-factor authentication everywhere possible and treat unsolicited messages with skepticism. Stay safe out there.