OpenAI Discloses Mixpanel Breach on Developer Platform

OpenAI disclosed a data breach involving its third-party analytics provider Mixpanel, which exposed personal information from accounts on its developer platform. The incident occurred on November 9, 2025, when attackers accessed Mixpanel's systems through a smishing attack, a form of phishing via text messages. Only users with accounts on platform.openai.com, where developers build applications using OpenAI's models, were affected, according to the company.

The breach did not compromise OpenAI's own infrastructure or the consumer-facing ChatGPT service. Stolen data included names and email addresses linked to API accounts, approximate locations derived from browser information, operating systems and browsers used to access the platform, referring websites, and organization or user IDs. OpenAI emphasized that no chat histories, API requests, usage data, passwords, credentials, API keys, payment details, or government IDs were exposed.

Mixpanel detected the unauthorized access on November 9 and contained the incident by securing affected accounts, revoking sessions, rotating credentials, and blocking malicious IP addresses. The company also conducted global password resets for...