Analytics firm Mixpanel has confirmed a security incident where a threat actor gained unauthorized access to an internal system. The breach led to the exposure of credentials for an internal analytics account belonging to its client, OpenAI.
Mixpanel announced that an attacker compromised a system that contained authentication tokens, which were then used to access some customer data. The company’s Chief Information Security Officer, Mark Loman, stated that a “small number of customers” were impacted by this unauthorized access.
Details of the Mixpanel Breach
According to Mixpanel, upon discovering the incident, the company took immediate steps to address the situation. These actions included rotating credentials to invalidate the compromised tokens and taking measures to remediate the unauthorized access. The firm also engaged third-party forensic experts to assist in its investigation of the cyberattack.
Impact on OpenAI
Following the disclosure from Mixpanel, OpenAI confirmed that it was affected by the breach. In a statement, OpenAI acknowledged that credentials for one of its internal analytics accounts were part of a data set stolen from Mixpanel. This exposed information is related to metadata about how users interact with OpenAI’s applications, such as ChatGPT.
OpenAI clarified the scope of the exposure, stating, “The exposed information was limited, and did not include user content or account information. We are continuing to investigate the matter.” The company became aware of the incident on June 18, 2024, and maintains that sensitive user data was not compromised.
Concise Cyber 