Mixpanel Security Breach
34 comments
·November 27, 2025thinkindie
I'm extremely confused by Mixpanel announcement, according to their blog post if you received an email from them it implies you were affected, yet I closed my account with them few months ago and I still received their email, which I can't understand if my account was impacted or no
> As a valued customer, we wanted to inform you about a recent security incident that affected a limited number of Mixpanel user accounts. We have proactively communicated with all impacted customers. If we did not previously contact you, your Mixpanel accounts were not impacted. We continue to prioritize security as a core tenant of our company, products and services. We are committed to supporting our customers and communicating transparently about this incident.
kronks
[dead]
autoexec
> datePublished":"2025-11-27T04:39:29.000Z
Considering they were aware of this on the 8th (who knows how long that was after it actually happened) it's a little disappointing that they'd wait until the day before such a major holiday to post about it. Unsurprising sure, but still disappointing.
bflesch
This is in breach of the 72hr GDPR notification window
ares623
Does that mean Mixpanel stock/valuation goes up because OpenAI uses them? That's how it works now is it?
weird-eye-issue
In the email they sent to users it's clear they don't use them anymore
kevcampb
The title here is misleading. The original article does not state breach and at no point have Mixpanel used that term.
EdwardDiego
"A security incident" is a nicer way of saying "security breach" once you run it through legal counsel.
The article you're reading states...
"We took comprehensive steps to _contain_ and eradicate unauthorized access"
That's a breach my friend.
kevcampb
That's a mixpanel breach if the unauthorised access was mixpanel staff accounts.
If someone phishes your gmail account, there is no gmail breach.
cobertos
It says "customers were impacted" and that they had to work to "eradicate unauthorized access"
It's just a very weazel-worded disclosure. Most definitely a breach.
willsmith72
Well OpenAI say users' names, emails and locations have been divulged, one of them is going to accept there was a "breach"
red_Seashell_32
OpenAI was sending that data to MixPanel. If anything, OpenAI is culprit for sensitive data leak. There’s absolutely no reason to send that data.
jacquesm
Companies use sub-processors all the time, OpenAI is no different. Unless you want to have everybody get a major case of NIH tomorrow (I wouldn't mind, then we can get rid of third party cookies and all advertising as well while we're at it).
Every time a google tag is included on a page a ton of sensitive data gets sent to another party than the one whose website you are visiting.
Whether it was wise or not for OpenAI to share this information with Mixpanel is another thing, personally I think they should not have but OpenAI in turn is also used by lots of companies and given their private data and so on.
This layercake of trust only needs on party to mess up for a breach to become reality. What I'm interested in is whether or not it was just OpenAI's data that was lifted or also other Mixpanel customers.
bflesch
If Mixpanel is subprocessor of GDPR'd data from OpenAI, OpenAI is obliged to notify affected European customers about the data breach within 72hrs.
aberoham
For context: https://news.ycombinator.com/item?id=46065585 OpenAI's announcement and https://news.ycombinator.com/item?id=46065208 CoinTracker’s
zdmc
@sama has raised lots of $ so why risk these types of issues by outsourcing what you have the funding to build and control in-house? plausible deniability? (similar with their prev? use of auth0)
willsmith72
you shouldn't try to innovate on everything, have to draw the line on buy/build somewhere
kangaroozach
Smushing is actually a pretty good name for this.
anonymous908213
I don't understand. I was assured that ChatGPT is AGI by Sam Altman. Why are security breaches still happening? Surely with several hundred billion dollars investment and access to AGI, they could use ChatGPT agents to create their own product analytics platform that is robust and resilient against such a trivial attack rather than selling off users' personal data to a third party.
weird-eye-issue
> selling off users' personal data to a third party.
You do realize that you pay for Mixpanel right?
anonymous908213
Theoretically speaking, payment could take the form of data as part of an enterprise agreement on rates charged. Notably, the OpenAI API privacy policy specifically states...
> We may also aggregate or de-identify Personal Data so that it no longer identifies you and use this information for the purposes described above, such as to analyze the way our Services are being used, to improve and add features to them, and to conduct research. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.
The fact that Mixpanel has this data in non-de-identified form is suspicious to me. Granted, my entire comment was clearly tongue-in-cheek. Although I think it's possible that OpenAI is selling this data to get a discount on Mixpanel usage, in reality I understand that the more likely explanation is that whoever was responsible for managing this data is completely and totally incompetent.
gotosun
So did an Mixpanel employee get phished or were Mixpanel customer accounts targeted, thus an OpenAI employee fell for it?
jvandenbroeck
It's a suspicious post, why would you make a post if attackers are performing a sms phishing, that happens all the time.
kevcampb
Possibly because OpenAI have just made a post stating there has been a breach https://openai.com/index/mixpanel-incident/ and implicating Mixpanel as the cause
EdwardDiego
But I thought the submitted title was misleading and there's no breach? You seem unsure.
LostMyLogin
I also just received an email from OpenAI regarding the incident.
red_Seashell_32
It was SMS Phishing, a.k.a. Social Engineering.
It anything, it’s opposite of breach.
autoexec
> It was SMS Phishing, a.k.a. Social Engineering... it’s opposite of breach.
A social engineering attack that enables an attacker to gain unauthorized access to Mixpanel's systems and export a dataset containing names, user IDs, location data, and email addresses sounds exactly like a breach to me.
jacquesm
That is not how it works.
A breach is unauthorized disclosure, the mechanism through which it is achieved is not relevant to that classification.
An employee that walks out with a file would also be classified as a breach, even if no systems got compromised from the outside.
null
denuoweb
Email from OpenAI: Transparency is important to us, so we want to inform you about a recent security incident at Mixpanel, a data analytics provider that OpenAI used for web analytics on the frontend interface for our API product (platform.openai.com). The incident occurred within Mixpanel’s systems and involved limited analytics data related to your API account.
This was not a breach of OpenAI’s systems. No chat, API requests, API usage data, passwords, credentials, API keys, payment details, or government IDs were compromised or exposed.
What happened On November 9, 2025, Mixpanel became aware of an attacker that gained unauthorized access to part of their systems and exported a dataset containing limited customer identifiable information and analytics information. Mixpanel notified OpenAI that they were investigating, and on November 25, 2025, they shared the affected dataset with us.
What this means for you User profile information associated with use of platform.openai.com may have been included in data exported from Mixpanel. The information that may have been affected was limited to: Name that was provided to us on the API account Email address associated with the API account Approximate coarse location based on API user browser (city, state, country) Operating system and browser used to access the API account Referring websites Organization or User IDs associated with the API account
I _hate_ how this is written. At no point does it disclose explicitly:
* What systems were accessed
* What information was potentially exposed
* Just how "proactively" they've been about this (no timeline)
* Numbers... The scale of any of it
---
Some comments from quoted portions of article
> Mixpanel detected a smishing campaign ...
Doesn't give any details on who the companion targeted, or how, or how widespread.
> We took comprehensive steps to contain and eradicate unauthorized access and secure impacted user accounts.
So there was definitely _some_ sort of unauthorized access, but doesn't say to which accounts or in what systems
> Performed global password resets for all Mixpanel employees
So... definitely sounds like they expected compromise of Mixpanel employee credentials