OpenAI has reported a data breach after hackers targeted its analytics partner, Mixpanel, using a smishing campaign.

This attack allowed the thieves to access customer profile metadata from OpenAI’s API portal.

What was exposed

The stolen information included names, email addresses, approximate locations, operating systems, browsers, and organization or user IDs.

No ChatGPT user data, passwords, API keys, or payment details were compromised.

Response and guidance
Mixpanel detected the attack on November 8 and activated incident response measures.

OpenAI terminated its use of Mixpanel and is notifying affected API customers.

Organizations should be cautious of phishing attempts and consider multi-factor authentication.

Wider implications
The incident highlights risk from third-party platforms and partners.

Even if a primary system is secure, secondary services can create vulnerabilities.

CISOs and security teams should review vendor security and monitor for unusual activity.

The event underscores the need for vigilance in managing partner and API security to protect sensitive data.

CrowdStrike fired an employee who shared internal information with a hacking group.

Screenshots of company dashboards, including an Okta portal, were posted publicly.

No system breach occurred
The company confirmed its systems were never compromised. Customers remained protected throughout the incident, and the situation has been referred to law enforcement.

What triggered the leak
Hackers initially claimed access through a third-party vendor, but CrowdStrike stated the exposed screenshots came directly from the insider’s computer.

Key takeaway for security teams
Insider threats remain a major risk. Monitoring access and employee behavior, combined with swift action, is critical to protect sensitive systems and data.

This case reinforces the importance of internal vigilance to prevent information leaks.

Michigan isn’t just flirting with bad tech policy—it’s toying with breaking the basic security plumbing of the modern internet.

Wrapped in "protect the children" branding, new proposals in Lansing would effectively ban or heavily restrict VPNs by forcing ISPs and websites to detect and block encrypted tunnels for Michigan users.

On paper, it’s about stopping teens from bypassing age verification for porn.

In practice, it’s a direct collision with how real-world IT, cloud, and remote work actually function.

VPNs are not a fringe tool for hiding adult content; they’re the standard way businesses, schools, hospitals, banks, and governments protect data in transit and stay compliant with federal security rules.

If Michigan normalizes breaking or banning VPNs, it’s not just attacking privacy—it’s attacking the same encryption that secures medical records, payroll, critical infrastructure, and every remote login you make from home.

That leaves companies and institutions facing an impossible choice: weaken their security to satisfy a state law or stay secure and become potential criminals.

And if lawmakers push ahead anyway, they shouldn’t be surprised when data centers, jobs, and serious cloud operations quietly leave Michigan behind.

Hornetsecurity's 2026 report shows email remains the top entry point for attacks.

Malware increased over 130%, scams rose 30%, and phishing grew 20%.

Attackers are exploiting overlooked file types like TXT and older DOC files to bypass security filters.

Ransomware returns
Ransomware incidents rose from 18% to 24% of organizations.

Attackers blend email, credential theft, and endpoint exploits to maximize impact.

Most victims did not pay ransoms, and companies are boosting immutable backups and disaster recovery plans.

AI changes the game
Attackers increasingly use AI to automate phishing, identify vulnerabilities, and create deepfake impersonations.

Organizations are adopting AI for detection, but governance lags behind, raising risks of data leaks and misuse.

Identity and access remain weak points
Phishing and MFA bypass attacks continue.

Stronger MFA methods like hardware keys and passkeys offer better protection, but adoption is inconsistent.

Helpdesk procedures and SaaS integrations also present attack opportunities.

Focus for CISOs
Email, AI-driven attacks, and identity weaknesses demand proactive monitoring and improved security practices.

Vendors and cloud services need careful oversight to prevent cascading breaches.

Security teams must address email threats, AI risks, and identity gaps to stay ahead of attackers.

AI is reshaping the cybersecurity landscape, creating new threats and opportunities at the same time.

Organizations face an urgent need for skilled defenders, as attacks grow faster and more sophisticated.

Bridging the Talent Shortage

Estimates suggest a global shortage of 2.8 to 4.8 million cybersecurity professionals.

Companies are turning to AI to help fill gaps, but technology alone is not enough.

Skilled human professionals remain critical for managing complex threats and making sound security decisions.

Balancing Technology and Human Expertise

AI helps detect threats, automate responses, and reduce breach costs.

Yet nearly half of IT leaders cite a lack of AI expertise among staff as a major challenge.

Soft skills like communication, creative thinking, and collaboration are as important as technical knowledge for effective cybersecurity.

Global Initiatives and Training

The World Economic Forum recommends a comprehensive approach: raise awareness, provide targeted training and certification, and integrate advanced security technologies.

Public-private partnerships and strategic frameworks can help build a sustainable, diverse, and capable workforce.

Preparing for the Future

Organizations that invest in both AI tools and human talent will be best positioned to withstand the next wave of cyber threats.

Closing the cyber skills gap is essential to maintain resilient and proactive security operations worldwide.

Signs Your Cybersecurity Framework May Need Rebuilding

Outdated cybersecurity frameworks can leave organizations exposed.

Security teams should regularly review and adjust their frameworks to keep up with evolving threats and operational changes.

Indicators of Weakness

Maintaining Resilience

Regularly updating and testing frameworks, integrating automation where possible, and ensuring alignment with both technology and business strategy are key steps to maintaining a strong cybersecurity posture.