OpenAI has sent an official notification to users regarding a security incident that occurred in an analytics service called Mixpanel. The company noted that the incident occurred only within Mixpanel systems and OpenAI's infrastructure was not compromised in any way.
The editorial staff reports that the incident involved the exfiltration of limited analytical data as a result of unauthorized access to Mixpanel systems in early November. This data includes username, email address associated with an API account, approximate location data, operating system and browser used, as well as referring sites and organization or user identifiers linked to the API account.
OpenAI stated that immediately after receiving information about the incident, it removed the Mixpanel service from its production environment, analyzed the compromised data, and tightened security requirements. The company also emphasized that it has strengthened its oversight of partners' and suppliers' adherence to security standards.
The statement advises users to be vigilant against possible phishing and social engineering attempts. OpenAI reminded users not to trust emails not originating from official domains and that passwords or API keys are never requested via email. The company also recommends enabling multi-factor authentication for more secure account protection.