What happened
OpenAI said that attackers accessed analytics data in the Mixpanel service, which is used to collect statistics on the developer platform.
Which data may have been compromised
Specifically, names, email addresses, and the approximate geolocation of some API users may have fallen into the hands of third parties. The company says that passwords, payment data, chat histories, and API requests were not stolen.
Response from OpenAI and Mixpanel
OpenAI said that its internal systems were not breached and urged developers to be cautious about suspicious emails and messages, as the stolen information could be used for phishing attacks.
Mixpanel confirmed receiving a report, informed affected customers and, according to CEO Jen Taylor, is cooperating with law enforcement. The compromise likely occurred through smishing — an attack using spoofed SMS messages.
