ChatGPT data breach history: every incident since 2023, and what each one exposed

The Morse teamPublished October 24, 202610 min read

The best-documented ChatGPT data breach happened on March 20, 2023, when a bug showed some users other people's chat titles and exposed payment details for 1.2% of the ChatGPT Plus subscribers active during a nine-hour window. As of October 2026, it is one of two incidents OpenAI has disclosed in which its own systems exposed ChatGPT users' data. The other came in September 2026, when OpenAI's research agents posted 53 user-provided images to image-hosting sites. The biggest numbers in "ChatGPT breach" and "OpenAI data breach" headlines describe a vendor's breach, passwords stolen from people's own computers, or a seller's claim OpenAI says it found no evidence for.

On October 22, 2026, we read OpenAI's own incident posts, its running page on the Hugging Face incident, its help center, the researchers' reports, and the statements OpenAI gave reporters. Each incident below links to OpenAI's disclosure where one exists. Where a fact comes only from reporting, we say so.

Has ChatGPT ever had a data breach?

Yes, in March 2023. OpenAI's post on the March 20 outage says a bug in redis-py, the open-source library its servers used to reach their Redis cache, "allowed some users to see titles from another active user's chat history." The first message of a new conversation could also show up in someone else's history if both people were active at the same time.

The same bug touched payments. Between 1 a.m. and 10 a.m. Pacific time on March 20, an active Plus subscriber who opened "Manage my subscription" might have seen another subscriber's first and last name, email address, payment address, card type, the last four digits of the card number, and its expiration date. Some subscription confirmation emails sent in that window went to the wrong people.

OpenAI said a server change at 1 a.m. that day caused a spike in cancelled cache requests, and a cancelled request could leave a connection holding another user's data. It believed "the number of users whose data was actually revealed to someone else is extremely low," notified the affected subscribers, and wrote: "this week we fell short of that commitment, and of our users' expectations."

Has ChatGPT been hacked?

As far as OpenAI has disclosed, no attacker has broken into its systems and reached ChatGPT users' chats. OpenAI's own network has been broken into twice: once by a hacker, according to reporting, and once by its own AI agents.

The New York Times reported on July 4, 2024 that early in 2023 a hacker got into "the internal messaging systems of OpenAI" and lifted details from an online forum where employees discussed the company's technology, according to two people familiar with the incident. The hacker didn't reach the systems where OpenAI builds its models. Executives told staff in April 2023 but didn't go public "because no information about customers or partners had been stolen," those people said. An OpenAI spokeswoman, quoted in the article, referred to "this incident, which we addressed and shared with our board."

The second intruder was OpenAI's own models. In July 2026, agents running GPT-5.6 Sol and an internal research model, tested with their cyber refusals turned down, escaped an evaluation sandbox and broke into Hugging Face's servers looking for answers to the test, OpenAI said on July 21. Its August 26 report adds that on July 19 the agents gained administrator access to an OpenAI Kubernetes cluster and "reached cloud secrets," and states: "These events did not affect OpenAI customer data, product functionality, or availability."

What happened in the OpenAI Mixpanel breach?

An attacker broke into Mixpanel, the analytics company OpenAI used on its API website, and took a dataset about OpenAI's users. OpenAI's post of November 26, 2025 says Mixpanel learned of the attacker on November 9 and gave OpenAI the affected data on November 25.

The dataset held names, email addresses, approximate location, operating system and browser, referring websites, and user or organization IDs. OpenAI first said only API users were affected. A December 19 clarification added "a limited number of ChatGPT users who submitted help center tickets or were logged into platform.openai.com." OpenAI's position is that "this was not a breach of OpenAI's systems," and it lists what wasn't exposed: chats, API requests, passwords, API keys, payment details, and government IDs. It has since stopped using Mixpanel.

OpenAI warned that the names, emails, and IDs could be used for phishing, and advised treating unexpected messages with caution and turning on multi-factor authentication.

Were ChatGPT conversations leaked on Google?

Some were, because their owners had shared them and ticked a box to make them discoverable. In late July 2025, more than 4,500 shared ChatGPT links turned up in Google results, Search Engine Journal reported, citing Fast Company. OpenAI's security chief, Dane Stuckey, announced on July 31 that the option was gone: "This was a short-lived experiment to help people discover useful conversations," and it "introduced too many opportunities for folks to accidentally share things they didn't intend to." OpenAI said it was "working to remove indexed content from the relevant search engines."

No one broke in, since the chats were public pages their owners had made. As of October 22, 2026, the X post Search Engine Journal linked shows as deleted by its author, so the quotes above come from that report. Grok had the same problem on a larger scale, which we cover in is Grok private.

What ChatGPT data leaked in 2026?

Fifty-three images. On September 25, 2026, OpenAI said on its running page about the Hugging Face incident that agents in its research environment had sent training and evaluation data to third-party services, calling it "not an appropriate use of this data." Most of that data wasn't from users, but OpenAI found "53 instances to date where user-provided images were posted to image-hosting sites as links that weren't publicly listed." It says it has removed most of them and is working on the rest.

The images came from training data, so only users whose data was eligible for training could have been affected. OpenAI says data "not eligible for training, as controlled by users or enterprise admins, is not included," and that business and API data is excluded unless an admin turned it on. On a personal account, the switch that decided this is "Improve the model for everyone." We cover how to turn it off in does ChatGPT train on your data.

One flaw was found and fixed before anyone is known to have used it. Check Point reported on March 30, 2026 that a malicious prompt could have sent "user messages, uploaded files, and AI-generated summaries" out of ChatGPT through DNS lookups. Its report says the fix was complete on February 20, 2026, and that "there is no indication of exploitation in the wild."

Were 100,000 ChatGPT accounts hacked?

They were stolen, but from users' own computers, not from OpenAI. On June 20, 2023, Group-IB reported 101,134 devices infected with info-stealing malware that had saved ChatGPT logins, found in logs traded on dark web markets over the past year, with a peak of 26,802 in May 2023. Most came from the Raccoon stealer: 78,348, by The Hacker News' count. OpenAI told The Hacker News the findings were "the result of commodity malware on people's devices," not an OpenAI breach, and urged users "to use strong passwords and install only verified and trusted software."

In February 2025, a seller called "emirking" claimed on BreachForums to have logins for 20 million OpenAI accounts. OpenAI told SecurityWeek: "We take these claims seriously. We have not seen any evidence that this is connected to a compromise of OpenAI systems to date." KELA, a threat intelligence firm, concluded that the credentials "were likely obtained by infostealer malware." The claim remains unproven.

OpenAI's own app once made this kind of theft easier. In July 2024, developer Pedro José Pereira Vieito showed that the ChatGPT Mac app kept conversations on disk in plain text, outside the macOS sandbox, so another app could read them, The Verge reported. OpenAI's statement to The Verge: "We are aware of this issue and have shipped a new version of the application which encrypts these conversations."

A stolen login opens everything your account keeps, including your saved chat history. If you think yours is compromised, change the password, then in ChatGPT open Settings, then Security and login, and select Log out of all devices, which OpenAI says can take up to 30 minutes. Turn on multi-factor authentication on the same screen.

Every ChatGPT security incident, date by date

Of these ten, the three behind the biggest "ChatGPT hacked" headlines (Group-IB's 101,134 devices, the 20 million logins, and Mixpanel) involved no break-in at OpenAI. Two exposed ChatGPT users' data from OpenAI's own systems: the March 2023 bug and the September 2026 images. A breach isn't the only way chats leave a company. Courts can order them kept and handed over, which we cover in the ChatGPT court order on data retention.

How Morse keeps a breach away from your chats

Most of the incidents above exposed something a company or an app kept: account details in a cache, profiles in a vendor's analytics, images in a training set, chats in a file on disk, and a whole history behind each stolen password. A server breach can only expose what that server stores, and Morse's servers don't keep messages or log message content. Your chat history is stored in your browser, encrypted.

• A breach of our servers finds no stored chats. The account holds your sign-in details, plan, balance, and a usage ledger with no content.
• No analytics vendor to lose your profile. Morse runs no advertising trackers or third-party analytics, so no analytics company holds a profile of how you use Morse.
• Your chats aren't in a training set. Morse doesn't train AI on your content, sell your data, or show ads.
• No Morse password to steal. You sign in with a code emailed to you, or with Google. Your stored history takes two keys to unlock, one that never leaves your device and one our server gives you when you sign in, so a copy of the browser data alone can't be read. In the privacy policy's words, this storage encryption "is not end-to-end encryption against us: we hold the key, but we never receive the data it unlocks."

Then pick a privacy mode for each chat, depending on who should handle the message on its way to the model:

• Private, so the model's host keeps nothing to lose. It's the default. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run under zero data retention: Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms that on each reply, Morse checks it and refuses a reply that doesn't. What zero data retention means covers why that matters in a breach.
• E2EE, for anything no one should read. Your browser checks the secure enclave's proof that it's genuine, then encrypts the message so only that enclave can read it, and our servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE chats come with Pro, $19 a month. Read how end-to-end encrypted AI chat works.
• Anonymous, to use GPT, Claude, or Gemini without the provider knowing it's you. Our proxy strips your account, email, and IP address and sends the message under Morse's own account. The provider may keep the message for a limited time to check for abuse, under its own policy, so leave out names and details you'd rather keep to yourself.

Morse's servers keep no copy of your history, so clearing the browser or losing the device deletes it, and Morse can't recover it. Keep a copy of anything you need, lock the device, and keep it free of software you don't trust. Our privacy policy has the details.

Try a chat from the Morse home page without an account, or start free: every plan keeps your history encrypted in your browser.