A severe data breach affecting Chat GPT users has recently been reported, allegedly carried out by a Russian hacker who claims to be selling login credentials for 20 million Open AI accounts on the notorious hacker marketplace, Breach Forums.
The leak was first revealed in a blog post by Malwarebytes Labs, which detailed the findings. The hacker, known as "emir king", posted samples of the stolen data on February 6, stating in Russian, "I have more than 20 million Open AI account access codes. If you want, contact me – it’s a treasure." The hacker, who joined Breach Forums in January 2025, is suspected to be a seasoned cybercriminal using a fresh alias to maintain anonymity.
Potential Threats and Open AI’s Vulnerabilities
Although the authenticity of the breach is still under investigation, security researchers warn that the stolen credentials could allow cybercriminals to bypass Open AI’s authentication systems, potentially gaining unrestricted access to user accounts. They dismissed the possibility of phishing attacks being responsible for the massive data collection, suspecting instead that the hacker may have exploited a vulnerability in Open AI’s authentication system. The breach might have involved manipulating Open AI’s subdomain "auth0.openai.com" or acquiring admin-level credentials.
If verified, the stolen login data could expose sensitive Chat GPT user information, including chat histories and queries. This could lead to social engineering attacks, phishing scams, and financial fraud. Additionally, attackers could misuse Open AI's API, potentially generating unauthorized charges for users subscribed to Chat GPT Plus or Pro plans.
What Should Users Do?
To mitigate risks, Malwarebytes recommends that all Open AI users take immediate action by:
✅ Changing their passwords immediately.
✅ Enabling multi-factor authentication (MFA) for added security.
✅ Monitoring account activity for any unusual behavior.
✅ Remaining cautious of phishing attempts based on previous Chat GPT conversations.
As cybersecurity threats continue to evolve, users must stay vigilant and prioritize account security.
留言