Technology

Third-party breach exposes ChatGPT account details

Published

3 months ago

December 14, 2025

Third-party breach exposes ChatGPT account details

NEWYou can now listen to Fox News articles!

ChatGPT went from novelty to necessity in less than two years. It is now part of how you work, learn, write, code and search. OpenAI has said the service has roughly 800 million weekly active users, which puts it in the same weight class as the biggest consumer platforms in the world.

When a tool becomes that central to your daily life, you assume the people running it can keep your data safe. That trust took a hit recently after OpenAI confirmed that personal information linked to API accounts had been exposed in a breach involving one of its third-party partners.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

The breach highlights how even trusted analytics partners can expose sensitive account details. (Kurt “CyberGuy” Knutsson)

What you need to know about the ChatGPT breach

OpenAI’s notification email places the breach squarely on Mixpanel, a major analytics provider the company used on its API platform. The email stresses that OpenAI’s own systems were not breached. No chat histories, billing information, passwords or API keys were exposed. Instead, the stolen data came from Mixpanel’s environment and included names, email addresses, Organization IDs, coarse location and technical metadata from user browsers.

FAKE CHATGPT APPS ARE HIJACKING YOUR PHONE WITHOUT YOU KNOWING

That sounds harmless on the surface. The email calls this “limited” analytics data, but the label feels like PR cushioning more than anything else. For attackers, this kind of metadata is gold. A dataset that reveals who you are, where you work, what machine you use and how your account is structured gives threat actors everything they need to run targeted phishing and impersonation campaigns.

The biggest red flag is the exposure of Organization IDs. Anyone who builds on the OpenAI API knows how sensitive these identifiers are. They sit at the center of internal billing, usage limits, account hierarchy and support workflows. If an attacker quotes your Org ID during a fake billing alert or support request, it suddenly becomes very hard to dismiss the message as a scam.

OpenAI’s own reconstructed timeline raises bigger questions. Mixpanel first detected a smishing attack on November 8. Attackers accessed internal systems the next day and exported OpenAI’s data. That data was gone for more than two weeks before Mixpanel told OpenAI on November 25. Only then did OpenAI alert everyone. It is a long and worrying silent period, and it left API users exposed to targeted attacks without even knowing they were at risk. OpenAI says it cut Mixpanel off the next day.

The size of the risk and the policy problem behind it

The timing and the scale matter here. ChatGPT sits at the center of the generative AI boom. It does not just have consumer traffic. It has sensitive conversations from developers, employees, startups and enterprises. Even though the breach affected API accounts rather than consumer chat history, the exposure still highlights a wider issue. When a platform reaches almost a billion weekly users, any crack becomes a national-scale problem.

Regulators have been warning about this exact scenario. Vendor security is one of the weak links in modern tech policy. Data protection laws tend to focus on what a company does with the information you give them. They rarely provide strong guardrails around the entire chain of third-party services that process this data along the way. Mixpanel is not an obscure operator. It is a widely used analytics platform trusted by thousands of companies. Yet it still lost a dataset that should never have been accessible to an attacker.

Companies should treat analytics providers the same way they treat core infrastructure. If you cannot guarantee that your vendors follow the same security standards you do, you should not be collecting the data in the first place. For a platform as influential as ChatGPT, the responsibility is even higher. People do not fully understand how many invisible services sit behind a single AI query. They trust the brand they interact with, not the long list of partners behind it.

Attackers can use leaked metadata to craft convincing phishing emails that look legitimate. (Jaap Arriens/NurPhoto via Getty Images)

8 steps you can take to stay safer when using AI tools

If you rely on AI tools every day, it’s worth tightening your personal security before your data ends up floating around in someone else’s analytics dashboard. You cannot control how every vendor handles your information, but you can make it much harder for attackers to target you.

1) Use strong, unique passwords

Treat every AI account as if it holds something valuable because it does. Long, unique passwords stored in a reliable password manager reduce the fallout if one platform gets breached. This also protects you from credential stuffing, where attackers try the same password across multiple services.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

2) Turn on phishing-resistant 2FA

AI platforms have become prime targets, so they rely on stronger 2FA. Use an authenticator app or a hardware security key. SMS codes can be intercepted or redirected, which makes them unreliable during large-scale phishing campaigns.

3) Use strong antivirus software

Another important step you can take to protect yourself from phishing attacks is to install strong antivirus software on your devices. This can also alert you to phishing emails and ransomware scams, helping you keep your personal information and digital assets safe.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

PARENTS BLAME CHATGPT FOR SON’S SUICIDE, LAWSUIT ALLEGES OPENAI WEAKENED SAFEGUARDS TWICE BEFORE TEEN’S DEATH

4) Limit what personal or sensitive data you share

Think twice before pasting private conversations, company documents, medical notes or addresses into a chat window. Many AI tools store recent history for model improvements unless you opt out, and some route data through external vendors. Anything you paste could live on longer than you expect.

5) Use a data-removal service to shrink your online footprint

Attackers often combine leaked metadata with information they pull from people-search sites and old listings. A good data-removal service scans the web for exposed personal details and submits removal requests on your behalf. Some services even let you send custom links for takedowns. Cleaning up these traces makes targeted phishing and impersonation attacks much harder to pull off.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Treat unexpected support messages with suspicion

Attackers know users panic when they hear about API limits, billing failures or account verification issues. If you get an email claiming to be from an AI provider, do not click the link. Open the site manually or use the official app to confirm whether the alert is real.

Events like this show why strengthening your personal security habits matters more than ever. (Kurt “CyberGuy” Knutsson)

7) Keep your devices and software updated

A lot of attacks succeed because devices run outdated operating systems or browsers. Regular updates close vulnerabilities that could be used to steal session tokens, capture keystrokes or hijack login flows. Updates are boring, but they prevent a surprising amount of trouble.

8) Delete accounts you no longer need

Old accounts sit around with old passwords and old data, and they become easy targets. If you’re not actively using a particular AI tool anymore, delete it from your account list and remove any saved information. It reduces your exposure and limits how many databases contain your details.

Kurt’s key takeaway

This breach may not have touched chat logs or payment details, but it shows how fragile the wider AI ecosystem can be. Your data is only as safe as the least secure partner in the chain. With ChatGPT now approaching a billion weekly users, that chain needs tighter rules, better oversight and fewer blind spots. If anything, this should be a reminder that the rush toward AI adoption needs stronger policy guardrails. Companies cannot hide behind transparent emails after the fact. They need to prove that the tools you rely on every day are secure at every layer, including the ones you never see.

Do you trust AI platforms with your personal information? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:ChatGPT cybercrime Featured Privacy

Click to comment

Technology

Soundcore new Space 2 promise improved ANC and sound

Published

2 hours ago

March 1, 2026

Press Room

Soundcore new Space 2 promise improved ANC and sound

We finally have an update to the Soundcore Space One that launched two and a half years ago. At MWC 2026, Soundcore has announced the Space 2, which will be available in the US on April 21st in three colors — linen white, jet black, and seafoam green — for $129.99. That’s $30 more than the Space One’s original price.

According to Soundcore, the Space 2 have had a full-band noise cancellation upgrade with the focus of those improvements on the low-frequency sounds we all generally use ANC headphones to block — things like airplane, train, and bus engine sounds while traveling. The Space 2 use the same number of microphones as the Space One for noise canceling, instead relying on optimized mic placement and structure and materials improvements for the boost in performance.

Redesigned 40mm drivers incorporate dual layers in their design. There’s a silk diaphragm with metal ceramic that supposedly results in faster transient response — the driver’s ability to respond to sudden sound quickly and accurately — with better balanced sound reproduction. The Space One had great sound performance for the price, but I’m all for any improvement to sound performance accuracy. Like the Space One, the Space 2 will support LDAC high-res audio.

The headphones connect wirelessly over Bluetooth 6.1, although they do not support Auracast transmissions — an unfortunate exclusion. There’s also a 3.5mm jack for a wired connection.

Battery life has been increased to up to 50 hours with ANC and 70 hours with ANC off. This is up from 40 hours with ANC and 55 hours without ANC with the Space One headphones. With a five-minute charge the Space 2 get an additional four hours of listening.

The Space 2 will include many of the features found on the Space One. You can use HearID 3.0 to go through a series of sound samples to tune the headphones’ sound to your preferences. It worked well for me on the Space One to get them closer to a sound I liked, with a bit of the edge taken off the higher frequencies. There’s also a sensor that detects when you remove the headphones and stops playback so you don’t miss any of your music or podcast. They once again come with a cloth bag that matches the color of the headphones instead of a case, which is one change I wish Soundcore had made, as the cloth bag doesn’t offer as much protection if you tend to throw your headphones into your backpack or bag.

The Soundcore Space One were among the best budget ANC headphones when they came out, and still hold up to more recent releases. But with the bump in price to over $100 for the Space 2, there’s a bit more expectation on them. ANC performance continues to improve — and products get cheaper — across manufacturers, so the Soundcore Space 2 has some competition from companies like Sony, EarFun, and JLab. If the ANC on the Space 2 stands up to current budget headphones and they still sound as good and are as comfortable as the Space One, you can expect to see the new Soundcore Space 2 on many recommendation lists.

Technology

Tired of websites blocking your VPN? A dedicated IP fixes that

Published

2 hours ago

March 1, 2026

Press Room

Tired of websites blocking your VPN? A dedicated IP fixes that

NEWYou can now listen to Fox News articles!

If you have ever turned on your VPN and suddenly could not log in to your bank, email, streaming service or work portal, you are not imagining things. In fact, this is one of the most common frustrations VPN users face today.

However, the issue is not that VPNs stopped working. Instead, websites have become far more aggressive about blocking traffic that looks suspicious.

As a result, the way your VPN is built now matters just as much as whether you use one at all.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

Shared VPN IPs often trigger red flags, which is why banks, email providers and streaming sites sometimes block access. (Kurt “CyberGuy” Knutsson)

Why websites block many VPN connections

Most VPNs give you a shared IP address. As a result, hundreds or even thousands of people can appear online from the same address at the same time. From a website’s perspective, that traffic pattern raises red flags. When platforms detect too many logins, rapid location changes or unusual activity tied to one IP, they step in quickly. In many cases, they respond by:

Blocking access
Triggering captchas
Requiring extra verification codes
Temporarily locking accounts

Meanwhile, you did nothing wrong. Instead, you end up dealing with restrictions caused by other users sharing that same IP address.

What a dedicated IP does differently

With a dedicated IP, you get an address that belongs only to you. Unlike shared VPN connections, no one else uses it.

Each time you connect, you use the same IP address. As a result, you avoid sharing traffic, rotating locations or competing with random users whose activity could trigger blocks.

Because of that consistency, your connection looks much more like a typical home or office internet setup. And that simple difference can dramatically reduce website suspicion and login headaches.

NEW YORK HALTS ROBOTAXI EXPANSION PLAN

A dedicated IP gives you a consistent address that looks more like a normal home connection, reducing captchas and login alerts. (Kurt “CyberGuy” Knutsson)

What a dedicated IP can do that shared VPN IPs usually can’t

That consistency does more than reduce suspicion; it improves how smoothly you access the sites and services you use every day.

Access more websites without blocks

Banks, government portals, healthcare sites, and streaming services are far less likely to block a dedicated IP because it does not show heavy or erratic traffic patterns.

Reduce captchas and security challenges

Those endless “prove you’re human” messages are usually triggered by shared IP abuse. A dedicated IP dramatically reduces them.

Make banking and email logins smoother

Financial institutions and email providers often flag constantly changing IP addresses as suspicious. A dedicated IP stays consistent, so login alerts and lockouts happen far less often.

Support remote work and secure systems

Some employers only allow access from approved IP addresses. Shared VPN IPs cannot be approved. Dedicated IPs can.

Improve streaming reliability

Shared VPN IPs are often the first to get blocked when streaming services crack down. Dedicated IPs are less likely to be flagged because traffic looks normal and predictable.

What a dedicated IP does not do

A dedicated IP:

Does not remove encryption
Does not expose your identity
Does not weaken your privacy

Your traffic remains encrypted, and your real location stays hidden. You simply get a connection that websites trust more.

Who benefits most from a dedicated IP

A dedicated IP is especially helpful if you:

Use online banking regularly
Travel and access sites from different locations
Work remotely
Stream often
Get tired of captchas and blocked pages
Want a VPN that feels normal to use

GOOGLE DISMANTLES 9M-DEVICE ANDROID HIJACK NETWORK

With fewer blocks and smoother logins, a dedicated IP helps your VPN work quietly in the background instead of getting in your way. (Kurt “CyberGuy” Knutsson)

How to choose a VPN that offers a dedicated IP

If you want these benefits, look for a VPN provider that offers a dedicated IP option built directly into its service. Some providers include it in premium plans, while others offer it as an add-on. Either way, the process should be simple. You should be able to select your dedicated IP inside the app without advanced setup or manual configuration. Before signing up, check that the provider also offers strong speeds, reliable uptime and clear privacy policies. A dedicated IP improves access, but overall performance still matters.

What to look for beyond a dedicated IP

A dedicated IP reduces blocks. However, a quality VPN should also deliver strong security and smooth performance.

Fast, stable connections: Speed matters for streaming, video calls and everyday browsing. Look for providers known for consistent performance.

Wide server coverage: More server locations give you flexibility when traveling and help reduce location errors.

Clear privacy practices: Choose a VPN with a strict no-logs policy and independent audits when possible.

Secure server technology: Modern VPNs often use RAM-based servers that automatically wipe data on reboot.

Easy-to-use apps: Protection should feel simple, not technical. Clean apps across major devices make daily use effortless.

For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android & iOS devices at Cyberguy.com

Kurt’s key takeaway

If your VPN keeps getting blocked, the problem may not be the VPN itself. It may be the shared IP address behind it. Websites are increasingly aggressive about suspicious traffic. When hundreds of users share the same IP, banks, email providers and streaming platforms take notice. That is when the captchas, verification codes and account lockouts start. A dedicated IP changes that experience. You still get encryption. You still protect your real location. But your connection looks stable and predictable, which helps you avoid constant interruptions.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Should protecting your privacy really mean fighting with your bank, email, and streaming apps? Let us know by writing to us at Cyberguy.com

Technology

Polymarket defends its decision to allow betting on war as ‘invaluable’

Published

14 hours ago

February 28, 2026

Press Room

Polymarket defends its decision to allow betting on war as ‘invaluable’

It might be World War III, but at least I won $20. | Image: Polymarket / The Verge

Polymarket has been allowing people to bet on when the US would strike Iran next. Obviously, now that it’s actually happened and people have died, the prediction betting market is feeling some pressure. The site has been at the center of controversy before, including suspicions of insider trading on the Super Bowl halftime show and the capture of Venezuelan President Nicolás Maduro.

In a statement posted on its site, Polymarket defended its decision to allow betting on the potential start of a war, saying that it was an “invaluable” source of news and answers, before taking shots at traditional media and Elon Musk’s X. The statement reads:

…

Read the full story at The Verge.