All security briefings

Supporting services Vendor data breach

Sensitive context includes the metadata around a product

Incident
November 2025; vendor discovery November 9
Source report

What was reported

OpenAI reported that a breach at analytics provider Mixpanel exposed limited identifying and analytics information for some API users and a limited set of ChatGPT users. Potential fields included names, email addresses, approximate location, browser details, and organization or user identifiers. OpenAI said its own systems were not breached and that chats, prompts, responses, passwords, and API keys were not exposed. It terminated its use of Mixpanel.

Read the report from OpenAI

Our perspective

Our reading: a data inventory needs to include supporting services, not just model requests. Metadata can identify people and reveal how they use a product. For Vivendur, minimizing collection and defining retention purposes matter alongside controlling which context reaches an AI tool.

Read about information moving between tools