OpenAI has announced that user profile data from its API products has been leaked due to a breach in its third-party partner, Mixpanel. This includes names, emails, location, and browser information. The company confirmed that passwords or authentication details were not leaked and has warned affected users to remain vigilant.
ChatGPT Data Leak Alert: OpenAI recently reported that user profile data from its API products has been leaked due to a breach in the company's third-party partner, Mixpanel. This incident involved the leakage of information such as account name, email, city, state, country, browser, and operating system. The incident came to light on November 25, 2025, and the company immediately removed Mixpanel from its systems and warned all affected users. OpenAI clarified that sensitive information like passwords or API Keys remained secure.
What Data Was Leaked?
According to OpenAI, this data leak involved profile-level details of API accounts. This includes information such as account name, email address, city, state, country, operating system, browser information, referring websites, user ID, and organization.
The company clarified that sensitive user-related information and authentication details, such as passwords or API Keys, were not leaked. This means that users' main accounts are secure, but their profile data could potentially be used in cyber attacks.
OpenAI's Actions
OpenAI became aware of this data leak on November 25. Subsequently, the company immediately removed Mixpanel from its production systems and initiated an audit of all its third-party vendors. The company also stated that it would further strengthen security measures to prevent such incidents in the future.
Concurrently, OpenAI has begun informing all affected companies, administrators, and users about the leak. Users have been advised not to click on any suspicious emails or links, and that OpenAI will never ask for passwords, API Keys, or verification codes.
Security Warning for Users
OpenAI has instructed affected users to remain vigilant to avoid phishing and cyber attacks. Users should exercise caution before clicking on personal information or links in any email.
The company states that these steps are necessary to enhance data security and prevent potential future risks.
