OpenAI Discloses Limited API User Data Exposure in Mixpanel Breach

OpenAI has notified users of its application programming interface that limited personal information may have been exposed in a security incident at Mixpanel, a third-party analytics provider the company used for web tracking. The breach, detected by Mixpanel on November 8, affected only a subset of OpenAI's API account holders and did not compromise the company's core systems or sensitive data such as passwords, API keys or chat histories.

Mixpanel, which OpenAI employed to analyze user interactions on its API platform at platform.openai.com, disclosed the incident on Thursday, describing it as a smishing attack, a form of phishing conducted via text messages. An unauthorized party gained access to a portion of Mixpanel's systems and exported a dataset containing customer identifiable information and usage analytics. Mixpanel responded by securing affected accounts, rotating credentials, revoking sessions, resetting passwords and blocking malicious IP addresses. The company also engaged external cybersecurity experts to contain the breach.

OpenAI received details of the compromised data from Mixpanel on November 25 and published an update on its website the following day. The...