Mixpanel’s data breach surprise raises a lot of questions

Just a heads up, if you buy something through our links, we may get a small share of the sale. It’s one of the ways we keep the lights on here. Click here for more.

Analytics giant Mixpanel quietly posted a vague blog update just hours before the Thanksgiving holiday, right when everyone was either traveling, cooking, or pretending to work. 

The post, written by CEO Jen Taylor, essentially said: Something bad happened on November 8, some customers were affected, we fixed stuff. 

And that was it. No details. No numbers. No explanation. Just a “trust us” and a quick fade-out.

TechCrunch tried following up with Taylor, sending over a dozen questions. Taylor didn’t respond. 

But OpenAI did, and that’s when things got interesting.

OpenAI published its own blog two days later and confirmed what Mixpanel hadn’t: customer data was stolen. 

Because OpenAI uses Mixpanel to analyze developer-facing website traffic, the breach likely exposed data from developers relying on OpenAI’s APIs. 

The stolen info included names, emails, rough locations based on IP addresses, and device details like operating systems and browser versions. 

Thankfully, it didn’t include more invasive identifiers like Apple’s IDFA or Android’s ad ID, which would’ve made tracking individuals far easier.

OpenAI stressed that regular ChatGPT users weren’t affected and promptly cut ties with Mixpanel.

The incident shines an uncomfortable spotlight on analytics companies, those behind-the-scenes data vacuums quietly attached to thousands of apps. 

Mixpanel, which boasts 8,000 corporate customers, collects vast amounts of granular user activity: every tap, swipe, login timestamp, device type, screen resolution, and even passwords once, due to a 2018 hiccup. 

These companies also offer “session replays,” visual recordings of how users navigate apps, handy for developers, nightmare fuel for privacy advocates.

The sheer volume of data flowing through Mixpanel’s systems means the number of everyday people affected could be massive, depending on how each customer configured their tracking. 

And because pseudonymized data can often be unscrambled, much of it is more identifying than companies admit.

Mixpanel hasn’t explained what happened or how deep the breach goes. 

But one thing is clear: analytics firms are becoming prime hacker targets, and this holiday weekend announcement won’t be the last time one is caught off guard.