OpenAI API Users’ Names, Emails, & More Exposed in Massive Mixpanel Data Breach

OpenAI has confirmed a new data breach involving Mixpanel, a third-party analytics provider previously used to monitor activity on platform.openai.com, the frontend for its API product. In an update, the company claims that its own systems weren’t compromised, and that the content, API usage, passwords, payment details, and government IDs are safe.

As reported, on November 9, 2025, Mixpanel detected unauthorized access to part of its systems. The attacker exported an analytics dataset containing identifiable information of some OpenAI API users. Mixpanel then apparently notified OpenAI, which launched an investigation.

By November 25, 2025, the affected dataset was confirmed. Only API platform users are said to be impacted by this security breach. In other words, ChatGPT and other OpenAI products were not affected.

The exposed data included:

• Names associated with OpenAI API accounts
• Email addresses
• Approximate location (city, state, country)
• Operating system and browser used
• Referring websites
• Organization or user IDs linked to accounts

OpenAI has since removed Mixpanel from its production environment and reviewed the affected datasets. Users and organizations potentially impacted by the security breach are being directly notified. The company has also ended its engagement with Mixpanel and is conducting security reviews across all vendor partners to strengthen protections.

As a safety guard, you must remain vigilant against phishing and social engineering attempts. OpenAI will never request passwords, API keys, or verification codes via email or chat. More importantly, we recommend enabling multi-factor authentication (MFA). In case you’ve any queries related to the security breach, you can reach OpenAI’s support team at [email protected]⁠.