Security brief

Mixpanel incident exposed limited OpenAI user analytics, not chat contents

REVIEW

OpenAI’s updated notice distinguishes identifying analytics from account credentials, API content and conversation data.

Published 29 Oct 2026 · Material update 19 Dec 2025 — last time the underlying evidence changed · Evidence: high

What happened

OpenAI disclosed a November 2025 incident at analytics provider Mixpanel involving limited identifying and analytics information. Potentially affected fields included names, email addresses, approximate locations, browser details and user or organization identifiers.

A December clarification added that some ChatGPT users who submitted help-center tickets or were logged into the API platform were also affected. OpenAI said chat content, API requests, passwords, API keys and payment details were not exposed.

OpenAI removed Mixpanel and notified affected users. The practical concern is credible-looking phishing using exposed context. Check unexpected messages carefully; OpenAI did not recommend password resets or API-key rotation solely because of this incident.

Read the original source.

Next step

Review any incident notification and be alert for targeted phishing.

What we know

Not exposed, according to OpenAI
Chat content, API requests, passwords, API keys and payment details.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references