OPENAI API USER DATA EXPOSED IN MIXPANEL BREACH, CHATGPT UNAFFECTED

Summary from the TLDR InfoSec newsletter

A breach of Mixpanel's analytics platform exposed OpenAI API user metadata, including names, emails, location data, internal user/org IDs, and browser information. No passwords, API keys, chat logs, or payment data were compromised, and ChatGPT users were unaffected. OpenAI immediately removed Mixpanel from production and notified impacted users. It is conducting a broader vendor security audit. This incident highlights third-party vendor risk. Organizations should inventory analytics tools that receive user data, enforce data minimization policies with vendors, have API users enable MFA, and monitor for targeted phishing using the exposed metadata.