OpenAI has issued a global security warning to millions of ChatGPT users after a data breach at Mixpanel, a third-party analytics provider used for its API platform. The company released and worldwide alert this week, which left many users wondering whether their data had been compromised. OpenAI, however, has now clarified that the incident occurred entirely within Mixpanel’s systems and not within OpenAI’s own infrastructure.
Why is OpenAI sending warnings to ChatGPT users?
OpenAI sent the warning to all ChatGPT users, regardless of whether they were affected, to avoid confusion and maintain transparency. According to the company, only a limited subset of analytics data tied to its API product was exposed. Importantly, OpenAI confirmed that no chat histories, passwords, API keys, payment details, government IDs, or usage logs were compromised.
The company notes that the compromised dataset involved analytics information from platform.openai.com, which is used by developers and organisations accessing OpenAI’s API products. It also reiterated that regular ChatGPT users, those who use the website or mobile app for everyday conversations, are not impacted by this security breach and do not need to take any action.
What is the security concern?
OpenAI explains that the security breach stems from an incident Mixpanel discovered on November 9, when an attacker gained unauthorised access to part of its systems and exported analytics data. Mixpanel informed OpenAI that the compromised dataset included limited customer-identifiable information. OpenAI received the full affected dataset on November 25 and began issuing alerts shortly after.
While the notification went out to all users, only those with API accounts are potentially affected and have been contacted directly with specific guidance.
Which users are affected by the ChatGPT warning?
OpenAI has made it clear that regular ChatGPT users, those who use the chatbot on the website or mobile app for everyday conversations, are not affected by the breach. Their data was not involved, and no further action is required.
The only group that may be impacted are API product users, such as developers, companies, or organisations who use platform.openai.com to integrate OpenAI’s API services. These users have been notified directly with more detailed information.
The exposed data includes basic profile information such as names, email addresses, approximate locations based on browser data, operating system and browser details, referring websites, and organisation or user IDs associated with API accounts.
OpenAI assures users that although this information is not highly sensitive, it could still be misused for phishing or social engineering attacks. As a precaution, the company has removed Mixpanel from all production environments and permanently ended its use of the analytics service.
OpenAI urges users to stay alert
In its advisory, OpenAI has also urged API users to stay vigilant about suspicious messages, especially those that appear credible or reference OpenAI products. Users are encouraged to double-check that any communication claiming to be from OpenAI is sent from an official domain, avoid clicking on unexpected links, and never share sensitive credentials via email, text, or chat. The company has also advised enabling multi-factor authentication and avoiding the public sharing of organisation or user IDs, which could be exploited by attackers.
– Ends
