OpenAI has suffered a significant data breach after hackers broke into the systems of its analytics partner Mixpanel and successfully stole customer profile information for its API portal, the companies have said in coordinated statements.

According to a post by Mixpanel CEO Jen Taylor, the incident took place on November 8 when the company “detected a smishing campaign and promptly executed our incident response processes.”

Smishing is a form of phishing-by-SMS against targeted employees, popular with hackers because text messages bypass normal enterprise controls. This gave the attackers access to Mixpanel’s system, allowing them to steal a range of metadata relating to platform.openai.com account profiles: