OpenAI discloses API customer data breach via Mixpanel vendor hack

OpenAI notified some ChatGPT API customers that limited analytics data was exposed after a breach at third-party analytics provider Mixpanel. Mixpanel says the attack stemmed from an SMS-phishing (smishing) campaign that impacted a small number of customers and exposed items such as provided names, email addresses, coarse location, device/browser metadata, referring sites, and organization or user IDs; no API keys, passwords, payment data, or chat content were disclosed. OpenAI removed Mixpanel from production, is notifying affected users and organizations, and advises vigilance for phishing and enabling 2FA.