OpenAI Suspends Mixpanel Use After Analytics Knowledge Breach

Synthetic intelligence analysis and growth big OpenAI has paused utilizing analytics supplier Mixpanel after it reported struggling an information breach that uncovered profile data. The third-party service supplier’s breach impacts builders and organizations that use OpenAI’s API providers.

See Additionally: OnDemand | Rework API Safety with Unmatched Discovery and Protection

“The incident occurred inside Mixpanel’s methods and concerned restricted analytics information associated to some customers of the API. Customers of ChatGPT and different merchandise weren’t impacted,” stated OpenAI in a Wednesday breach notification.

ChatGPT maker OpenAI used Mixpanel to assemble analytics to assist it perceive how prospects interacted with its API instruments.

“This was not a breach of OpenAI’s methods. No chat, API requests, API utilization information, passwords, credentials, API keys, cost particulars, or authorities IDs had been compromised or uncovered,” OpenAI stated.

Mixpanel detected the breach on Nov. 9, after which it knowledgeable OpenAI that it was probing the assault, and {that a} menace actor “gained unauthorized entry to a part of their methods and exported a dataset containing restricted buyer identifiable data and analytics data,” OpenAI stated.

The corporate eliminated Mixpanel from its manufacturing methods throughout its investigation, reviewed the dataset to find out the scope of publicity, and started straight notifying all affected organizations, directors and customers, it stated.

The corporate stated it is discovered “no proof of any impact on methods or information exterior Mixpanel’s setting” and that it’s persevering with to observe for indicators of any wider breach.

The corporate did not instantly reply to a request for remark about what number of customers and organizations it is straight notifying concerning the breach.

Compromised information consists of profile particulars related to OpenAI platform accounts, equivalent to names, electronic mail addresses, approximate areas, working methods, browser data, referring web sites, plus group or consumer IDs related to the account.

OpenAI stated the first threat to customers will likely be social engineering and phishing assaults. “Since names, electronic mail addresses, and OpenAI API metadata – e.g., consumer IDs – had been included, we encourage you to stay vigilant for credible-looking phishing makes an attempt or spam,” the corporate warned prospects.

OpenAI stated prospects needn’t reset passwords however ought to deal with emails containing suspicious hyperlinks, attachments or requests for authentication data with excessive warning.

The disclosure follows broader trade scrutiny of third-party vendor safety as AI suppliers scale their infrastructure. AI growth pipelines usually depend on exterior analytics, cloud APIs and open-source mannequin parts, creating new dependency factors that attackers can exploit. A 2025 BitSight report warned that AI providers more and more push delicate telemetry and model-related information into vendor ecosystems, elevating the influence of breaches involving monitoring or analytics companions.

Gartner’s 2025 Hype Cycle for Provide Chain Technique likewise stated that as organizations embed AI deeper into operations, the safety of supporting distributors turns into vital to the resilience of the AI stack itself.

The Mixpanel incident highlights how even trusted analytics instruments can inadvertently leak delicate information and thus should be frequently monitored, stated Mayur Upadhyaya, CEO at APIContext. “In a machine-first world, you’ll be able to’t repair what you’ll be able to’t see. Observability should lengthen throughout each API, webhook and third-party integration,” he informed Info Safety Media Group.