Data analytics company Mixpanel suffered a security breach in November 2025, exposing account information for some OpenAI API users. OpenAI has since terminated its relationship with Mixpanel and begun notifying affected customers.
Mixpanel Smishing Attack: How the Breach Happened
Mixpanel is a product analytics platform that helps enterprises track user behavior across websites, apps, and APIs. The company analyzes key metrics, including retention rates, conversion rates, feature usage, and user journeys. OpenAI used Mixpanel as a third-party web analytics provider to understand product usage and improve its API platform (platform.openai.com), which powers text generation, natural language processing, and computer vision.
On November 8, 2025, Mixpanel detected a smishing campaign — a type of phishing attack conducted via SMS text messages designed to trick employees into revealing their login credentials. The following day, November 9, Mixpanel discovered that an attacker had gained unauthorized access to part of their systems and exported a dataset containing customer information.
Mixpanel immediately launched its incident response process, which included:
Securing affected accounts and revoking all active sessions and sign-ins
Rotating compromised Mixpanel credentials for impacted accounts
Blocking malicious IP addresses
Registering indicators of compromise (IOCs) on its SIEM platform
Performing global password resets for all Mixpanel employees
Engaging a third-p
Source: https://www.how2shout.com/news/mixpanel-data-breach-openai-api-users-exposed-november-2025.html
Mixpanel cybersecurity rating report: https://www.rankiteo.com/company/mixpanel-inc-
"id": "MIX1764305924.477763",
"linkid": "mixpanel-inc-",
"type": "Breach",
"date": "11/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'incident': {'affected_entities': [{'customers_affected': 'Some OpenAI API '
'Users',
'industry': 'Data Analytics / Product '
'Analytics',
'location': None,
'name': 'Mixpanel',
'size': None,
'type': 'Private Company'},
{'customers_affected': 'Users of '
'platform.openai.com '
'(API Customers)',
'industry': 'Artificial Intelligence',
'location': None,
'name': 'OpenAI',
'size': None,
'type': 'Private Company (AI Research '
'Lab)'}],
'attack_vector': 'Smishing (SMS Phishing)',
'customer_advisories': 'OpenAI notified affected customers',
'data_breach': {'data_encryption': None,
'data_exfiltration': True,
'file_types_exposed': None,
'number_of_records_exposed': None,
'personally_identifiable_information': None,
'sensitivity_of_data': 'Moderate (Account '
'Information, Potentially '
'Including User Behavior '
'Metrics)',
'type_of_data_compromised': ['Account '
'Information']},
'date_detected': '2025-11-08',
'description': 'Mixpanel, a data analytics company, suffered a '
'security breach in November 2025 due to a '
'smishing attack. The breach exposed account '
'information for some OpenAI API users, leading '
'OpenAI to terminate its relationship with '
'Mixpanel and notify affected customers. The '
'attacker gained unauthorized access to '
"Mixpanel's systems and exported a dataset "
'containing customer information on November 9, '
'2025.',
'impact': {'brand_reputation_impact': 'Negative (Loss of Trust '
'from High-Profile Client: '
'OpenAI)',
'conversion_rate_impact': None,
'customer_complaints': None,
'data_compromised': ['Account Information of OpenAI '
'API Users'],
'downtime': None,
'financial_loss': None,
'identity_theft_risk': 'Potential (Exposed Account '
'Information)',
'legal_liabilities': None,
'operational_impact': 'OpenAI terminated its '
'relationship with Mixpanel; '
'incident response measures '
'implemented (e.g., session '
'revocation, credential '
'rotation, IP blocking)',
'payment_information_risk': None,
'revenue_loss': None,
'systems_affected': ['Mixpanel Internal Systems',
'Customer Data Repository']},
'initial_access_broker': {'backdoors_established': None,
'data_sold_on_dark_web': None,
'entry_point': 'Smishing (SMS Phishing '
'Targeting Employee '
'Credentials)',
'high_value_targets': ['OpenAI API '
'User Account '
'Information'],
'reconnaissance_period': None},
'investigation_status': 'Ongoing (Incident Response Activated; '
'No Public Closure Mentioned)',
'post_incident_analysis': {'corrective_actions': None,
'root_causes': ['Smishing Attack '
'Success Due to Human '
'Error (Credential '
'Theft)']},
'ransomware': {'data_encryption': None,
'data_exfiltration': True,
'ransom_demanded': None,
'ransom_paid': None,
'ransomware_strain': None},
'references': [{'date_accessed': None,
'source': 'Incident Description (Provided Text)',
'url': None}],
'regulatory_compliance': {'fines_imposed': None,
'legal_actions': None,
'regulations_violated': None,
'regulatory_notifications': None},
'response': {'adaptive_behavioral_waf': None,
'communication_strategy': ['OpenAI notified '
'affected customers',
'OpenAI terminated '
'relationship with '
'Mixpanel'],
'containment_measures': ['Securing affected '
'accounts',
'Revoking all active '
'sessions and sign-ins',
'Rotating compromised '
'Mixpanel credentials',
'Blocking malicious IP '
'addresses',
'Registering Indicators of '
'Compromise (IOCs) on SIEM '
'platform'],
'enhanced_monitoring': None,
'incident_response_plan_activated': True,
'law_enforcement_notified': None,
'network_segmentation': None,
'on_demand_scrubbing_services': None,
'recovery_measures': None,
'remediation_measures': ['Global password resets '
'for all Mixpanel '
'employees'],
'third_party_assistance': 'Engaged (Partial '
'Mention: Third-Party '
'Involvement Implied)'},
'title': 'Mixpanel Security Breach Exposing OpenAI API User '
'Account Information',
'type': 'Data Breach / Unauthorized Access',
'vulnerability_exploited': 'Human Error (Credential Theft via '
'Smishing)'}}