Analytics vendor breach exposed names and emails of OpenAI API users
What happened
An attacker broke into Mixpanel, an analytics provider OpenAI used on its API platform, and exported names, email addresses, approximate locations and browser details of some API users. OpenAI said no chats, API keys or payment data were involved and stopped using Mixpanel.
OpenAI used Mixpanel for web analytics on platform.openai.com, the site developers use to manage API accounts. Mixpanel said the intrusion began with an SMS phishing campaign on 8 November 2025, and on 9 November an attacker exported a dataset from its systems. After investigating, Mixpanel sent OpenAI the affected data on 25 November. For some API users it contained the name and email address on the account, approximate location based on the browser, operating system and browser details, referring websites, and user or organization IDs. OpenAI said no chats, API requests or usage data, passwords, API keys, payment details or government IDs were involved, and that ChatGPT users and other products were not affected. Because the data ties real names and emails to developer accounts, OpenAI warned it could be used for convincing phishing.
How it happened
Supply chain and access: Third-party leak. Data leaked through a vendor or tool connected to the AI service rather than the AI service itself.
The AI involved was from OpenAI. The product was OpenAI API platform, a type of AI building block.
Impact
Data was exposed. Data involved: personal data. The impact was confined to one organization and its users or customers.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 9 Nov 2025. It became public on 26 Nov 2025, 17 days later.
OpenAI disclosed the incident on 26 November, removed Mixpanel from its production systems, began notifying affected organizations and users, and said it was raising security requirements for all its vendors. Mixpanel revoked sessions, rotated credentials and brought in outside forensic experts.