OpenAI Reveals API User Data Exposure After Mixpanel Security Breach

OpenAI has confirmed that some data related to its API users—such as names, email addresses, and approximate locations—may have been compromised following a recent Mixpanel security breach. The company stated on Thursday that while the sensitive data of users accessing ChatGPT, the Sora app, and the ChatGPT Atlas browser remained unaffected, certain information tied to OpenAI’s application programming interface (API) users might have been exposed. OpenAI has begun a full security investigation and has stopped using Mixpanel services.

OpenAI’s API Data Potentially Breached

In a newsroom post, OpenAI explained that the incident occurred on November 9, when Mixpanel’s systems were hacked. The attacker managed to export a dataset that included limited user-identifiable information and analytics data belonging to OpenAI’s API users. Mixpanel shared details of the affected dataset with OpenAI on November 25 as part of its own ongoing investigation.

OpenAI emphasized that its servers, products and core systems were not impacted. Crucial information—such as API requests, API usage data, passwords, credentials, API keys, payment information and government IDs—was not compromised.

Regarding the scope of exposed information, OpenAI stated that certain profile details associated with “platform.openai.com” accounts might have been included in the exported dataset. These details could include:

Name provided on the API account

Email address linked to the API account

Approximate location (city, state, country) based on browser data

Operating system and browser used

Referring websites

Organization or user IDs associated with the account

As a precaution, OpenAI has removed Mixpanel from all production services. The company has also reviewed the impacted datasets and is working closely with Mixpanel and other partners to assess the full extent of the breach. “While we have found no evidence of any effect on systems or data outside Mixpanel's environment, we continue to monitor closely for any signs of misuse,” the company stated.