CyphrQ
Menu

ChatGPT Data Breach? What OpenAI Has Disclosed, 2023 to 2025

What OpenAI says happened in the March 2023 ChatGPT bug and the 2025 Mixpanel incident, what data was exposed, and what to ask your AI vendors.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: March 202312 min read

Has there been a ChatGPT data breach? OpenAI has published two security incidents. In March 2023 a bug let some users see other users' chat titles, and payment details of 1.2% of ChatGPT Plus subscribers active in a nine-hour window. In November 2025, an analytics vendor, Mixpanel, was breached and limited account data was exposed. OpenAI says its own systems were not breached in the second case.

This is a case file. It sticks to what OpenAI and the regulator wrote, says plainly what is not known, and ends with questions to ask your own AI providers.

Case file

Field March 2023 ChatGPT bug November 2025 Mixpanel incident
Organisation OpenAI Mixpanel (OpenAI's analytics vendor)
Region Global service Global service
What happened A bug in an open-source library (redis-py) in OpenAI's caching layer returned one user's data to another (OpenAI) An attacker accessed part of Mixpanel's systems and exported a dataset (OpenAI)
Key dates Change introduced 1 a.m. Pacific, Monday 20 March 2023. OpenAI's post is dated 24 March 2023 Mixpanel became aware 9 November 2025; it shared the dataset with OpenAI on 25 November 2025. OpenAI's post is dated 26 November 2025, clarified 19 December 2025
People affected Some users saw other users' chat titles. Payment-related information of 1.2% of ChatGPT Plus subscribers active in a nine-hour window "may" have been visible Some API users, plus "a limited number of ChatGPT users who submitted help center tickets or were logged into platform.openai.com". OpenAI gives no total
Data types Chat titles; for some Plus users, first and last name, email, payment address, card type, last four digits, card expiry. "Full credit card numbers were not exposed at any time" Name, email, approximate location (city, state, country), operating system and browser, referring websites, organisation or user IDs
Not exposed (per OpenAI) Full card numbers Chats, API requests, API usage data, passwords, credentials, API keys, payment details, government IDs
Regulator action Italy's Garante fined OpenAI EUR 15 million in December 2024. That decision was later removed from the Garante's site after a court upheld OpenAI's appeal None found in sources we read
Status Bug patched; users notified OpenAI ended its use of Mixpanel

What happened in the March 2023 ChatGPT bug?

OpenAI took ChatGPT offline on 20 March 2023. Its post four days later opens: "We took ChatGPT offline earlier this week due to a bug in an open-source library which allowed some users to see titles from another active user's chat history" (OpenAI).

It also said the first message of a newly created conversation could have been visible in another person's chat history, if both users were active around the same time.

OpenAI restored the service and, later, the chat history feature, "with the exception of a few hours of history".

Whose payment details were exposed in the ChatGPT bug?

After a deeper investigation, OpenAI said the same bug "may have caused the unintentional visibility of payment-related information of 1.2% of the ChatGPT Plus subscribers who were active during a specific nine-hour window" (OpenAI).

OpenAI describes two ways another user's details could have shown up, both on Monday 20 March between 1 a.m. and 10 a.m. Pacific time:

  1. A misaddressed email. Some subscription confirmation emails sent in that window went to the wrong people. They contained the card type and last four digits of another user's card.
  2. The subscription page. A Plus user who opened "My account" and then "Manage my subscription" might have seen another active Plus user's name, email, payment address, card type, last four digits and expiry date.

OpenAI's own wording on scale is cautious. It said it believed "the number of users whose data was actually revealed to someone else is extremely low". That is a belief, not a count, and OpenAI did not publish one. We don't either.

OpenAI said it reached out to notify affected users that their payment information may have been exposed.

What caused the March 2023 ChatGPT bug?

The root cause was a race between cancelled requests and a reused connection. OpenAI's explanation, in its own words and ours (OpenAI):

  • OpenAI uses Redis to cache user information so it does not query its database on every request. It uses Redis Cluster to spread the load.
  • Its Python server talks to Redis through the redis-py library, running with Asyncio.
  • The library keeps a shared pool of connections and recycles each one for another request when done.
  • If a request is cancelled after it is sent but before the response is read, "the connection thus becomes corrupted and the next response that's dequeued for an unrelated request can receive data left behind in the connection."
  • Usually that causes a server error. But "in some cases the corrupted data happens to match the data type the requester was expecting", so it looks valid even though it belongs to someone else.

A change OpenAI made at 1 a.m. Pacific on 20 March "caused a spike in Redis request cancellations". That raised the odds. OpenAI says the bug appeared only in the Asyncio redis-py client for Redis Cluster, and has been fixed.

The point for non-engineers: nobody broke in. A shared cache handed one customer's answer to another customer.

How did OpenAI respond to the 2023 bug?

OpenAI listed these actions (OpenAI):

  • It sent the Redis maintainers a patch as soon as it found the bug.
  • It added "redundant checks to ensure the data returned by our Redis cache matches the requesting user".
  • It examined its logs to confirm messages were only available to the right users.
  • It correlated several data sources to identify affected users, and improved logging to confirm the problem had stopped.
  • It improved the robustness and scale of its Redis cluster.

What did the Mixpanel incident involve?

Mixpanel is "a data analytics provider OpenAI used for web analytics on the frontend interface for our API product (platform.openai.com)" (OpenAI). OpenAI's headline claim: "This was not a breach of OpenAI's systems."

OpenAI's timeline:

  • On 9 November 2025, Mixpanel "became aware of an attacker that gained unauthorized access to part of their systems and exported a dataset containing limited customer identifiable information and analytics information."
  • Mixpanel told OpenAI it was investigating.
  • On 25 November 2025, Mixpanel shared the affected dataset with OpenAI.
  • OpenAI published its post the next day, 26 November.

Mixpanel's own statement dates things slightly differently. It says it "detected a smishing campaign" on 8 November 2025, that it contacted every impacted customer, and that the incident "impacted a limited number of our customers" (Mixpanel). Smishing is phishing by text message. The two accounts differ by a day on when awareness began. We don't know why, and neither source says.

OpenAI's 19 December 2025 clarification matters. The original post said "API users" were affected. It was updated to add that the incident "also affected a limited number of ChatGPT users who submitted help center tickets or were logged into platform.openai.com." OpenAI says all impacted users were notified at the same time, and nothing else about its understanding changed.

What data did the Mixpanel incident expose?

OpenAI lists six items, and says the information was "limited to" them (OpenAI):

Data Detail
Name As provided on the account
Email address Associated with the account
Approximate location City, state, country, from the browser
Device details Operating system and browser
Referring websites Where the user came from
IDs Organisation or user IDs

OpenAI says no chat, API requests, API usage data, passwords, credentials, API keys, payment details or government IDs were exposed, and that session and authentication tokens were not affected. Because of that, it did not recommend password resets or API key rotation. It did warn the data "could be used as part of phishing or social engineering attacks", and recommended multi-factor authentication, at the single sign-on layer for organisations.

What did OpenAI change after the Mixpanel incident?

OpenAI says it removed Mixpanel from production services, reviewed the affected datasets, and began notifying organisations, admins and users. It then "terminated its use of Mixpanel". It also said it is "conducting additional and expanded security reviews across our vendor ecosystem and are elevating security requirements for all partners and vendors" (OpenAI).

We have not seen a published list of those new requirements, so we can't say what they are.

Did a regulator act on the ChatGPT data breach?

Italy's data protection authority, the Garante, did, and then the outcome was reversed. Here is only what the Garante's own pages say.

On 20 December 2024 the Garante announced it had closed its investigation of OpenAI with a EUR 15 million fine (Decision No. 755 of 2 November 2024). Among its findings, it said OpenAI failed to notify the Authority of the data breach suffered in March 2023 (Garante).

That decision is no longer standing. The Garante's website now carries a notice that it has temporarily removed Decision No. 755 "following judgment No. 4153/2026 of the Court of Rome", published on 18 March 2026, which upheld OpenAI's appeal (Garante).

We have not read that judgment, so we don't describe its reasoning. Treat the breach-notification finding as not upheld. Do not quote the EUR 15 million as a penalty OpenAI owes.

Going deeper: for security and IT teams

Caching bugs and session isolation. The 2023 incident is a cross-tenant data leak caused by connection state, not by an attacker. The mechanism OpenAI describes is a desynchronised request/response pair on a pooled connection. A cancelled asyncio task leaves an unread response on the wire. The next borrower of that connection reads it. Most of the time the type mismatch fails loudly. Occasionally the shape matches and the wrong user's data passes as valid.

What to take from it for your own systems:

  • Bind responses to the requester. OpenAI's fix includes "redundant checks to ensure the data returned by our Redis cache matches the requesting user". Any cache that stores per-user data should return the owner's ID with the value, and the caller should compare it before use. This turns a silent leak into an error.
  • Treat cancellation as a first-class failure path. Test what happens to pooled connections when requests time out or are cancelled under load. OpenAI's trigger was a server change that spiked cancellations.
  • Load-test with cancellations and compare identities. A test that fires many concurrent, randomly cancelled requests as different users, and asserts every response belongs to the caller, would have a chance of catching this class of bug.
  • Log for detection. OpenAI says it improved logging "to identify when this is happening". Log the user ID that made the request and the user ID in the cached payload. A mismatch is an alert.
  • Know your dependency. The flaw sat in an open-source client. Track the client libraries on your data path, and know how you would learn of and apply an upstream fix.
  • Check transactional email. The misaddressed subscription emails show that leaked identity can travel through every system that reads the same cache. Review which messages are built from cached state.

Vendor data minimisation. In the Mixpanel case, the exposed data was what OpenAI had chosen to send to an analytics tool: names, emails, coarse location, device details and IDs. The vendor, not OpenAI, was breached, and the data still carried the OpenAI brand into phishing risk. Questions for your own analytics and support vendors:

  • Which fields do we send, and is each one needed? Could we send a pseudonymous ID instead of name and email?
  • Do vendor scripts load on authenticated pages, as OpenAI's did on platform.openai.com?
  • Can we export what a vendor holds on us, and delete it, on request?
  • Is the vendor's own access protected against smishing and help-desk style attacks, which Mixpanel says started its incident?

What to ask AI providers about incident notification. Neither OpenAI post gives a number of affected people for its main incident. So ask for specifics in the contract, not the blog post:

  1. Within how many hours will you notify us of an incident that touches our data, and through which channel?
  2. Do you notify us of sub-processor incidents, and when? In the Mixpanel case, Mixpanel shared the dataset with OpenAI on 25 November, and OpenAI posted the next day.
  3. Will you state what data classes were and were not involved, as OpenAI did, so we can decide on resets or key rotation?
  4. Do you publish a sub-processor list, and will you tell us before adding one?
  5. What evidence do you provide after an incident: root cause, scope, and the controls changed?

The Italian case shows why notification terms matter. The Garante's finding on breach notification was part of a decision that has since been taken off its site, so it is not a safe precedent either way. Your contract is a better source of truth than a regulator's earlier press release.

What to verify yourself. Check that single sign-on with MFA is required for your organisation's accounts on AI platforms, as OpenAI recommends. Ask staff to treat unexpected email that mentions an AI vendor account with suspicion. List which AI tools carry company data, which my earlier post on what to keep out of AI chatbots at work helps with.

What should teams using OpenAI or other AI providers do now?

  1. Turn on MFA for every account on AI platforms, enforced at single sign-on where you can.
  2. List the analytics, support and monitoring vendors that receive user data. Cut fields they don't need.
  3. Add an incident-notification clause, with hours and channel, to AI and sub-processor contracts.
  4. Add a test that checks every cached response belongs to the user who asked.
  5. Brief staff that an email naming your AI provider account may be phishing, even when it quotes real details.

Key takeaways

  • OpenAI has disclosed two incidents on its own site: the March 2023 ChatGPT caching bug and the November 2025 Mixpanel vendor incident.
  • In 2023, a bug in the redis-py library may have exposed payment-related details of 1.2% of ChatGPT Plus subscribers active in a nine-hour window. Full card numbers were not exposed, per OpenAI.
  • In 2025, OpenAI says Mixpanel, not OpenAI, was breached. Names, emails, coarse location, device details, referrers and IDs were involved; chats, passwords, API keys and payment details were not.
  • Italy's EUR 15 million fine over the 2023 breach is no longer standing. The Garante removed the decision after Rome judgment No. 4153/2026 upheld OpenAI's appeal.
  • Both incidents are about plumbing: a shared cache, and a third-party tool. Your own risk sits in the same places.
  • Ask AI providers for notification hours, sub-processor disclosure and a stated list of data involved.

Sources