# Mixpanel smishing breach exposes OpenAI API users' names and emails · pwn.watch

> Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.

Page: https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025 · generated 2026-10-22T21:47:37.879Z

## Status
- Severity: medium · status: closed · patch: no-fix-needed
- Product: Mixpanel (analytics vendor); OpenAI API platform users
- Started: 2025-11-08 · closed: 2025-11-27
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025/feed.xml
- JSON Feed: https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025.json
- This file: https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025/llms.txt

## Updates (newest first)
- 2025-11-26: OpenAI discloses impact on API users and drops Mixpanel (https://openai.com/index/mixpanel-incident/)
- 2025-11-08: Mixpanel detects the smishing campaign and unauthorized export (https://openai.com/index/mixpanel-incident/)

## Fix brief
# Security brief: Mixpanel smishing breach exposes OpenAI API users' names and emails

Source: https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025 · status: closed (closed Nov 27, 2025) · severity: medium · updated Nov 27, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.

Severity detail: Vendor breach; limited profile data

- Product: Mixpanel (analytics vendor); OpenAI API platform users

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Nov 26, 2025: OpenAI discloses impact on API users and drops Mixpanel
- Nov 8, 2025: Mixpanel detects the smishing campaign and unauthorized export

## Advisories
- [What to know about a recent Mixpanel security incident](https://openai.com/index/mixpanel-incident/) (OpenAI)

## Write-ups & news
- [OpenAI discloses API customer data breach via Mixpanel vendor hack](https://www.bleepingcomputer.com/news/security/openai-discloses-api-customer-data-breach-via-mixpanel-vendor-hack/)
- [OpenAI User Data Exposed in Mixpanel Hack](https://www.securityweek.com/openai-user-data-exposed-in-mixpanel-hack/)

## Caveats
OpenAI disclosure date (Nov 26) approximate.

---
Machine-readable: https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.