Case openai-mixpanelModel & data leakWorldwide
OpenAI API user data exposed in breach of analytics vendor Mixpanel
An attacker who smished Mixpanel exported a dataset with names, emails and coarse locations of OpenAI API users; OpenAI said no chats, keys or payment data were exposed.
MediumAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Nov 26, 2025
- Location
- Worldwide
- Target
- OpenAI API platform users
- Severity
- Medium
- Triggered by
- Unknown attacker who smished Mixpanel employees
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
An attacker who smished Mixpanel exported a dataset with names, emails and coarse locations of OpenAI API users; OpenAI said no chats, keys or payment data were exposed.
Impact: Names, email addresses, approximate location, browser and OS details of OpenAI API users exposed; no prompts, API keys, passwords or payment data. Other Mixpanel customers also affected.
Who triggered it
Actor: Unknown attacker who smished Mixpanel employees
Attribution: No public attribution; disclosed by Mixpanel and OpenAI
Motive: Data theft; one unverified report said the attacker tried to sell the dataset
How it happened
Attack vector: SMS phishing (smishing) of Mixpanel staff leading to access to internal systems and export of analytics datasets
Root cause: Third-party analytics vendor with user metadata; employee credentials compromised via social engineering
Timeline
- Mixpanel detects smishing campaign against employees
- Mixpanel identifies unauthorized access and data export; notifies OpenAI
- Mixpanel shares the affected dataset with OpenAI
- OpenAI publicly discloses the incident
- OpenAI clarifies some ChatGPT users were also affected
Response
Mixpanel revoked sessions, rotated credentials, blocked IPs and hired outside forensics firms; OpenAI removed Mixpanel from production and notified affected users.
Current status: Contained
Sources (open in a new tab)
- OpenAI openai.com
- CSO Online csoonline.com
- eWeek eweek.com
Cite this case
OpenAI API user data exposed in breach of analytics vendor Mixpanel. AI Threat Watch, case openai-mixpanel, Nov 26, 2025. https://aithreat.io/cases/openai-mixpanel/
Permanent link: https://aithreat.io/cases/openai-mixpanel/