At 2:00 AM, the OpenAI security team received an urgent notification from Mixpanel, a third-party data analytics service provider, stating that its system used for front-end tracking and statistics on platform.openai.com had been compromised by hackers. OpenAI acted swiftly, removing Mixpanel scripts from the entire site and cutting off data channels, effectively preventing further data leaks. The official statement emphasized that the core system was unaffected, and ChatGPT and the consumer version of the service were operating normally, but some user information on the developer platform may have been stolen.
According to the investigation, the data that the hackers may have obtained includes account names, linked email addresses, city-level location information, operating system and browser versions, referring websites, and user or organization IDs. OpenAI specifically pointed out that core assets such as chat logs, API request content, passwords, and API keys were not leaked; the attack only involved non-sensitive metadata. The source of the incident is still being traced, and affected users have received email alerts, urging them to be vigilant against potential phishing attacks.
This incident is another security alert for OpenAI caused by a third-party service, following the Redis vulnerability in 2023. The company reiterated that the platform itself has no vulnerabilities, but acknowledged that while outsourcing data statistics services reduced engineering costs, it introduced a new attack surface. This incident has once again drawn industry attention to the security risks of third-party service supply chains.
