Every OpenAI Security Breach and Data Incident, Documented (2023–2025)

OpenAI Security Data Breach

Last updated: May 2026

OpenAI has experienced at least four distinct security failures since 2023: an unreported internal forum breach, a Redis database bug that exposed paying subscribers’ payment data, a third-party analytics vendor compromise that leaked API customer records, and a UI misconfiguration that published private conversations to Google search results. None of these incidents involved a single attacker penetrating the core model infrastructure — but together they reveal a pattern that matters far more than any one breach.

The question isn’t whether OpenAI got hacked. The question is why a company holding conversation data from hundreds of millions of users keeps failing at the same layer: the gap between its own systems and everything orbiting them.

---

What Actually Happened: A Timeline of Every OpenAI Security Incident

Before analyzing the pattern, here is every documented incident, in order, with what was actually confirmed versus what was claimed.

Date	Incident	Data Exposed	Disclosed Publicly?
Early 2023	Internal employee forum breached	AI design discussions between researchers	No — only told to staff and board
March 2023	Redis bug (ChatGPT outage)	Conversation titles + payment info for ~1.2% of Plus subscribers	Yes, after outage became visible
2024 (ongoing)	Infostealer campaigns harvesting credentials	3M+ OpenAI account credentials on dark web	No direct disclosure; third-party discovery
Feb 2025	“20 million credentials” dark web claim	Unverified; traced to existing infostealer logs	OpenAI did not comment
Nov 2025	Mixpanel vendor breach	API user names, emails, location metadata	Yes — users notified Nov 27
2025	Shared conversation Google indexing	Private conversation content via search engines	Partial — UI fix deployed

---

The AI Vendor Trust Collapse Stack: How OpenAI’s Security Keeps Failing at the Same Level

Competing coverage treats each of these incidents as a standalone story. That framing misses the structural problem. I’ve mapped OpenAI’s security failures across what I call the AI Vendor Trust Collapse Stack — four layers where a company like OpenAI can lose control of user data, ordered from most to least visible to the public.

Layer 1 — Core Infrastructure (the model, weights, training data, API backbone) Layer 2 — Internal Communications (employee discussion systems, internal tooling) Layer 3 — Third-Party Vendor Integrations (analytics, CDN, CRM, monitoring services) Layer 4 — Application Surface (UI behavior, caching, data sharing features)

OpenAI has not been meaningfully breached at Layer 1 — the model itself remains intact. But it has failed, documented, at Layers 2, 3, and 4. The pattern is not bad luck. It’s the predictable result of an organization that scaled user exposure faster than it scaled security governance.

Incident 1: The 2023 Internal Forum Breach OpenAI Never Told the Public About

Layer: Internal Communications (Layer 2)

In early 2023, an attacker gained access to OpenAI’s internal messaging systems — specifically, an online forum where employees discussed research and technology developments. The attacker extracted details about the design of OpenAI’s AI systems from those conversations.

OpenAI’s executives told employees at an all-hands meeting in April 2023. They did not notify the public, and they did not notify law enforcement. Their stated rationale: no customer data had been stolen, and they believed the attacker was acting alone with no foreign government affiliation, meaning no national security risk triggered mandatory disclosure.

The incident was only surfaced publicly in July 2024 — sixteen months later — when the New York Times reported it based on two people with direct knowledge.

Why this matters beyond the breach itself: Several OpenAI employees pushed back internally. Leopold Aschenbrenner, then a technical program manager focused on AI safety, sent a memo to the board arguing the company’s security posture was inadequate and that a more sophisticated attacker — a state actor — could exploit the same gaps later. His concerns were dismissed. In April 2024, OpenAI fired Aschenbrenner, citing alleged information leaks. He disputed that framing publicly.

The legitimate concern employees raised — that an internal forum containing sensitive technical discussions had no adequate access controls — has never been formally addressed in public. OpenAI’s response was to fix the underlying issue and say nothing externally.

What was actually at risk: OpenAI’s internal employee forum in 2023 was a repository of unfiltered technical thinking about frontier AI systems. Discussion threads likely included capability assessments, safety test results, architectural decisions, and internal debates about deployment risks. Even if the attacker lacked the compute to act on what they learned, the intelligence value to a sophisticated state-sponsored actor would be significant.

Incident 2: The March 2023 Redis Bug — Payment Data Leaked to Other Users

Layer: Application Surface (Layer 4)

In March 2023, a bug in the Redis client library used by ChatGPT caused users to see conversation history from other users’ accounts. The bug also exposed payment information — specifically, the last four digits of credit card numbers, expiration dates, and payment addresses — for roughly 1.2% of ChatGPT Plus subscribers active at the time.

OpenAI took ChatGPT offline, patched the library, and disclosed the incident. CEO Sam Altman posted publicly acknowledging the issue.

This incident later became the subject of regulatory action in Europe. Italy’s data protection authority (the Garante) cited OpenAI’s failure to properly notify the authority about this March 2023 breach as one of several violations underlying its €15 million GDPR fine issued in November 2024. The Garante also found that OpenAI had processed personal data for ChatGPT training without an adequate legal basis, and that the platform lacked proper age verification mechanisms.

OpenAI labeled the Italian fine “disproportionate” and appealed. In March 2025, a Rome court provisionally suspended the fine pending appeal. In March 2026, the Court of Rome annulled the Garante’s decision entirely — a significant reversal that left Europe’s first GDPR enforcement action against a generative AI company without legal standing.

What to take from this: The Redis incident is a standard software bug. It happens. But the Italian enforcement timeline — from a 2023 breach to a 2024 fine to a 2026 annulment — illustrates how slowly regulatory mechanisms move relative to the pace of AI deployment. The practical deterrent effect on industry behavior is close to zero on any relevant timescale.

Incident 3: The Mixpanel Vendor Breach — API Customer Data Leaked Through a Third Party

Layer: Third-Party Vendor Integrations (Layer 3)

This is the incident most people mean when they search “OpenAI data breach” in 2025. On November 8, 2025, an attacker accessed Mixpanel’s systems — Mixpanel being a product analytics platform OpenAI used to track API user behavior. The attacker exported a dataset containing customer-identifiable information: names, email addresses, and browser-derived location data (city, state, country) associated with OpenAI API accounts.

OpenAI suspended its relationship with Mixpanel, notified affected users by November 27, and stated clearly: no chat logs, no API keys, no payment information, and no authentication tokens were compromised.

What actually happened technically: Mixpanel told its customers it had detected a “smishing” campaign — a text message phishing attack — that enabled the attacker to gain initial access to its systems. Mixpanel’s CEO Jen Taylor confirmed that customers who did not receive direct notification were not impacted.

The issue no competitor is covering: OpenAI’s use of Mixpanel to track API customers collected name, email, and location data — not strictly necessary for product analytics at the granularity required for improving AI model performance. A security researcher quoted in post-breach coverage flagged this as a potential violation of GDPR’s data minimisation principle: if you don’t need to store precise location data for analytics, you shouldn’t be storing it. OpenAI held that data inside a vendor’s system, applied vendor-level (not OpenAI-level) security controls to it, and only discovered the gap existed when it became a breach.

David Schwed, COO of AI security firm SovereignAI, characterized this to Decrypt as a “recursive supply chain” problem: users trust OpenAI, OpenAI trusts Mixpanel, and security gaps at the peripheral link compromise the entire stack. That is precisely what the AI Vendor Trust Collapse Stack predicts.

Incident 4: The 20 Million Credential Claim — What the Dark Web Actually Had

Layer: Application Surface and Infostealer Ecosystem

In February 2025, a threat actor called “emirking” posted on BreachForums claiming to possess over 20 million OpenAI account access codes. The post included a sample of 15 credential sets.

Threat intelligence firm KELA analyzed the sample and found no evidence of a direct OpenAI breach. The 30 credentials examined all matched data from previously known infostealer malware campaigns — primarily Redline, RisePro, LummaC2, StealC, and Vidar. KELA’s data lake showed infections spanning October 2023 through July 2024.

The actual scale of credential exposure through infostealers is not trivial: KELA’s researchers documented over 3 million compromised OpenAI-platform accounts in 2024 alone, gathered through infostealer campaigns unrelated to any direct breach of OpenAI’s infrastructure. These credentials were not stolen from OpenAI — they were stolen from infected user machines.

OpenAI’s culpability here is limited but not zero: The company cannot control whether users run malware on their personal machines. It can — and should — enforce mandatory multi-factor authentication for API accounts, which would render stolen password credentials useless. As of early 2025, MFA remains optional, not mandatory, for standard ChatGPT accounts.

The Regulatory Landscape: What Governments Have Actually Done

The United States federal response has been slow. The FTC opened an investigation into OpenAI in July 2023, demanding documents related to data security practices and ChatGPT’s tendency to generate inaccurate personal information. That investigation remains ongoing with no public enforcement action as of this writing.

EPIC (the Electronic Privacy Information Center) filed a formal complaint with the FTC in October 2024, documenting OpenAI’s data collection practices in detail — including the collection of payment card information, IP addresses, precise location, and the contents of user messages — and alleging violations of FTC Act Section 5 unfair or deceptive practices standards.

In Europe, as detailed above, Italy’s Garante was the only DPA to reach a final enforcement decision — and that decision was annulled on appeal in March 2026. The European Data Protection Board’s ChatGPT Taskforce, established in April 2023, published preliminary views in May 2024 but no binding decisions. Investigations in Spain, Poland, France, and Germany remain open.

The practical state of play: OpenAI faces significant regulatory scrutiny on multiple continents and has paid zero enforceable fines as of May 2026. Regulatory pressure has, however, produced some structural changes — OpenAI established a European legal entity (OpenAI Ireland Limited) in February 2024, introduced European data residency options for enterprise customers, and updated its regional privacy notice. These are meaningful governance improvements, even if they arrived under pressure rather than by initiative.

CISA’s guidance on third-party vendor risk management and NIST’s incident response framework (SP 800-61) both address the structural failure OpenAI demonstrated with Mixpanel: vendor risk management requires active security controls on third-party integrations, not post-breach remediation.

What You Actually Need to Do if You Use ChatGPT or the OpenAI API

For ChatGPT personal accounts

Enable MFA now. Go to Settings → Security → Two-factor authentication. This is the single most effective action against credential stuffing from infostealer-sourced data. If your email and password have been harvested by malware at any point, MFA is the gap between an attacker owning your account and failing to access it.

Review your conversation sharing settings. Shared conversations with “Make this chat discoverable” enabled are or were indexable by search engines. Go to ChatGPT → Settings → Data Controls and audit any shared links. Delete links to conversations containing personal, professional, or sensitive information.

Assume your prompts are not confidential. OpenAI’s privacy policy explicitly states it may share personal information with third parties without additional notice — as demonstrated by the Mixpanel incident. Treat every ChatGPT conversation as a semi-public record. Never enter credentials, personal identification numbers, proprietary source code, client names, medical information, or financial data into any ChatGPT session, regardless of account tier.

For API customers and enterprises

Audit your vendor data flows. The Mixpanel breach happened because OpenAI held user metadata — name, email, location — in a third-party analytics platform. Map which third parties in your own supply chain hold user data on your behalf. CISA’s supply chain risk management resources provide a framework for conducting this audit systematically.

Use OpenAI’s Zero Data Retention (ZDR) API option if your use case supports it. Under ZDR, OpenAI does not retain prompts or completions — they are not stored, not used for training, and would not appear in any breach. Enterprise and ZDR customers were explicitly excluded from the court-ordered data preservation ruling in May 2025.

Rotate API keys after any third-party security event. API keys were confirmed not compromised in the Mixpanel breach, but rotation costs nothing and eliminates residual exposure from any uncovered lateral access.

The Axis Intelligence Verdict: What OpenAI’s Security Record Actually Tells You

The framing in most coverage — “OpenAI was hacked” or “OpenAI wasn’t really hacked” — misses the operational reality.

OpenAI’s model infrastructure appears intact. No evidence suggests the weights, training data, or core API systems have been compromised. That is a meaningful distinction and should be stated clearly.

But OpenAI has demonstrably failed at vendor security governance, application-layer data minimization, and internal disclosure transparency — on multiple documented occasions over a three-year period. The company held more user data in more third-party systems than was necessary, discovered security gaps reactively rather than proactively, and in the 2023 internal forum case, made a unilateral decision not to disclose a security incident that its own employees believed warranted public disclosure.

For individual ChatGPT users: the personal risk is real but manageable. Enable MFA, stop entering sensitive data into prompts, audit your shared links. The breach history does not suggest your conversations are being actively read by attackers — it suggests they could be exposed by the next vendor OpenAI has given access to your account metadata.

For enterprises and API customers: the risk profile is more serious. You are trusting not just OpenAI’s security posture but the posture of every vendor in OpenAI’s supply chain. Zero Data Retention agreements and contractual security requirements for AI API integrations are no longer optional risk management — they are baseline due diligence.

The company that holds the most intimate AI conversations in history — therapy sessions, legal drafts, medical questions, business strategies — should be held to a higher disclosure and governance standard than it has demonstrated. That is not an anti-AI position. It is the position that any security-literate person who has read the incident record would reach.

---

Frequently Asked Questions

Was OpenAI hacked?

Technically, yes — multiple times, in different ways. An attacker accessed OpenAI’s internal employee forum in 2023. A third-party analytics vendor (Mixpanel) was breached in November 2025, exposing API customer names, emails, and location data. A Redis bug in March 2023 exposed payment information for roughly 1.2% of ChatGPT Plus subscribers. What has not been confirmed is any breach of OpenAI’s core model infrastructure, training data, or API backend.

Was my ChatGPT conversation data leaked?

Not in any confirmed incident. The Mixpanel breach exposed account-level metadata (name, email, location) for API customers only — not conversation content. The 2023 internal forum breach involved employee discussions, not user data. No confirmed incident has exposed ChatGPT conversation logs.

What is the Mixpanel breach?

On November 8, 2025, attackers accessed the systems of Mixpanel — a product analytics company that OpenAI used to track API user behavior. The attacker exported a dataset containing names, email addresses, and approximate browser locations for some OpenAI API customers. OpenAI terminated its Mixpanel relationship and notified affected users by November 27, 2025.

Was the “20 million OpenAI credentials” claim real?

Almost certainly not as claimed. Threat intelligence firm KELA analyzed a sample from the February 2025 dark web post and found all credentials matched data from previously known infostealer malware campaigns — meaning they were stolen from infected user machines, not from OpenAI’s systems directly. In 2024 alone, KELA documented over 3 million compromised OpenAI accounts sourced from infostealer logs.

Did OpenAI pay any GDPR fines?

Italy’s data protection authority fined OpenAI €15 million in November 2024 for multiple GDPR violations. OpenAI appealed, won a provisional suspension in March 2025, and the Court of Rome annulled the fine entirely in March 2026. No GDPR fine against OpenAI is currently enforceable. FTC proceedings in the United States remain ongoing with no public enforcement action.

Is it safe to use ChatGPT for work?

It depends entirely on what you’re entering. ChatGPT is not safe for entering client names, proprietary code, personally identifiable information, or anything subject to confidentiality obligations (legal, medical, financial). For general research, drafting, and analysis using non-confidential information, the practical breach risk is low for individual users. Enterprises should evaluate OpenAI API under a Zero Data Retention agreement and a formal vendor security assessment.

What should I do if I think I was affected by the Mixpanel breach?

OpenAI stated it notified all affected users directly. If you received no notification and are an API customer, OpenAI’s position is that you were not impacted. Regardless, enable MFA, monitor your registered email for phishing attempts referencing OpenAI, and consider whether your API account email address appears in known data breach databases (Have I Been Pwned is one tool for this).

Does OpenAI have a bug bounty program?

Yes. OpenAI operates a bug bounty program through Bugcrowd, with rewards up to $20,000 for critical vulnerabilities. Responsible disclosure of security vulnerabilities is encouraged. Security researchers who discover issues in OpenAI’s systems can report through that channel.

What changed after the Mixpanel breach?

OpenAI suspended its Mixpanel relationship, announced stricter security requirements for external partners, and initiated broader security reviews of its vendor integrations. The company did not publicly specify what new security standards it will apply to analytics vendors going forward.

What is OpenAI’s current regulatory status?

As of May 2026: FTC investigation ongoing (no enforcement action). EU: Italy’s GDPR fine annulled on appeal; EDPB taskforce investigations ongoing in multiple member states; Ireland’s DPC is the designated lead supervisory authority for OpenAI’s ongoing operations under the one-stop-shop mechanism. OpenAI Ireland Limited (established February 2024) is the entity of record for European regulatory purposes.

---

Marcus Chen is Axis Intelligence’s cybersecurity editor, covering data breaches, privacy regulation, and enterprise security. This article was researched and written independently; Axis Intelligence has no commercial relationship with OpenAI or any vendor mentioned.