2025 Smishing attack — millions of users across 8,000 customers

2025 Unknown records affected

Data compromised

Names, email addresses, location data, device info, user IDs, behavioral analytics

Technical writeup

Mixpanel fell victim to a sophisticated SMS phishing (smishing) attack on November 8-9, 2025. Unauthorized access to customer data across the platform. ShinyHunters claimed responsibility. Affected customers included OpenAI, SoundCloud, PornHub, and others. Data exposed: names, email addresses, approximate location, device info, user IDs, behavioral analytics. Passwords and payment info remained secure.

Root cause

SMS phishing (smishing) attack on employees; social engineering.

References

https://techcrunch.com/2025/12/02/a-data-breach-at-analytics-giant-mixpanel-leaves-a-lot-of-open-questions/
https://mixpanel.com/blog/sms-security-incident/