On November 9, 2025, Mixpanel, a third-party analytics provider used by OpenAI, discovered that attackers had gained unauthorized access to its systems and exported a dataset containing customer information. The breach was caused by a social engineering campaign, specifically smishing attacks targeting Mixpanel employees with fake MFA reset messages to steal credentials and bypass authentication protections. OpenAI was officially notified of the incident on November 25, 2025, and publicly disclosed it on November 26-27, 2025. The compromised data included names and email addresses associated with OpenAI API accounts, approximate location information derived from browser metadata (city, state, or country), browser and operating system details, referring websites, and organization or user IDs. Critically, the breach did not expose sensitive information such as ChatGPT user conversations, passwords, payment information, or API keys, meaning regular ChatGPT users were not directly affected. This incident represents a supply chain attack, highlighting the vulnerability of organizations to breaches at their third-party vendors. OpenAI responded by immediately suspending its use of Mixpanel and committing to conduct a comprehensive security review of all vendors. The breach raises important questions about vendor security practices and the responsibility of major technology companies to ensure their third-party partners maintain adequate security standards. While the exposed data is limited in scope compared to what could have been compromised, it still poses risks to affected API users whose identities and contact information are now in the hands of attackers. This incident underscores the cybersecurity principle that organizations are only as secure as their vendors' weakest security practices.
Why it matters:
- Demonstrates critical vulnerabilities in third-party vendor security and supply chain risks for major tech companies
- Raises concerns about data protection practices and the need for stricter vendor security oversight in the industry
Key Points
- Mixpanel breach on November 9, 2025 exposed OpenAI API user names, emails, and location data through social engineering attacks
- ChatGPT users, conversations, passwords, and payment information were not affected by the breach
- OpenAI suspended Mixpanel use and committed to security reviews of all third-party vendors
- Breach caused by smishing attacks targeting Mixpanel employees to steal credentials
- Supply chain attack highlights organizational vulnerability to third-party security failures
Source: Read original