ClosedMediumNo fix needed

Mixpanel smishing breach exposes OpenAI API users' names and emails

Mixpanel (analytics vendor); OpenAI API platform users

Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.

Why this severity: Vendor breach; limited profile data

Started: Nov 8, 2025
Closed: Nov 27, 2025

Follow this incident

Updated Nov 27, 2025

Affected

Fixed in

No fixed release yet

Timeline2

Nov 26, 2025
OpenAI discloses impact on API users and drops Mixpanel
Source
Nov 8, 2025
Mixpanel detects the smishing campaign and unauthorized export
Source

Advisories1

What to know about a recent Mixpanel security incidentOpenAI

News & write-ups2

Notes & caveats

OpenAI disclosure date (Nov 26) approximate.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified