OpenAI leaked customer data belonging to API users following a hack at third-party analytics provider Mixpanel. Unauthorized parties managed to export records containing names, email addresses, and approximate location data, along with information about operating systems and browsers. Organization and user IDs, as well as referring websites, were also part of the exposed data.
According to OpenAI, critical information—such as passwords, API keys, and chat content—was not accessed during the breach. The company also confirmed that ChatGPT users are not affected.
The incident took place on November 9, 2025, prompting OpenAI to immediately stop using Mixpanel. The company is currently notifying affected organizations directly and warning them to watch out for phishing attempts that might exploit the stolen metadata. Moving forward, OpenAI plans to enforce stricter security requirements for all external partners.
