442

cross-posted from: https://discuss.online/post/31211123

I honest to fucking God don't understand how cybersec is so fucking bad that there are so many damn data breaches that I lost count. I had a few accounts on chatgpt (that I dont use anymore) but they are all compromised now...

Just what the fuck is this shit? Are they done by lone actors or cybercrime gang? Or are they state actors or state-backed actors? Or are they inside jobs to allow the company to sell data illegally to make more money? Flock has admitted to using data from data breaches to their system.

You also notice how rarely you hear about cybercriminals getting caught? It's almost like if you take even a minor bit of opsec you can get away with anything.

top 50 comments
sorted by: hot top controversial new old
[-] NotSteve_@piefed.ca 81 points 5 days ago

confirm[ing] that a ton of user data has been exposed owing to a breach in a third-party web analytics tool called Mixpanel.

Important detail to know before commenting: it was Mixpanel analytics apparently that was breached and not ChatGPT itself.

Another reason to have Firefox strict privacy mode turned on along with uBlock and Disconnect though :)

[-] unexposedhazard@discuss.tchncs.de 28 points 5 days ago

analytics tools often have full access to everything on the page so this might as well be comparable to a breach of chatgpt itself

[-] NotSteve_@piefed.ca 11 points 5 days ago

For sure, yeah. When I joined my current company that provides a web service, I was blown away by how much is recorded. DataDog has a feature called RUM & Session Replay and I don't think people realise that every mouse movement, click, and interaction in general is recorded in enough detail that as a developer I can play back user sessions as if I were watching a screen recording. Mixed with the fact that it also captures as much identifying information as it can, it's pretty fucking creepy

[-] RustyShackleford@piefed.social 8 points 5 days ago

Good thing I blocked Mixpanel the second I saw it pop up for analytics. Call me paranoid.

[-] Taldan@lemmy.world 5 points 5 days ago* (last edited 5 days ago)

Why is that an important detail? Does itbmakeba functional difference to me as a user? OpenAI collected the data and failed to secure it. Doesn't matter if a 3rd party was involved

[-] NotSteve_@piefed.ca 2 points 5 days ago

It's important because none of OpenAI's software or databases were hacked. What was hacked was a service they use. As much as I dislike it, most companies that have a presence online use analytical services

Doesn't matter if a 3rd party was involved

involved isn't the correct term for this, or rather it's exact opposite direction. The 3rd party was hacked and as a result OpenAI data was leaked (along with any other companies using the platform that were affected)

I bring it up because the nuance is important when I can predict people will jump on OpenAI to make claims of shoddy code. I hate OpenAI and Sam Altman but again, the nuance is important because this can happen to any company

Get mad at the fact analytic companies collect enough data to cause this much of a mess if anything

[-] zeca@lemmy.ml 1 points 5 days ago

OpenAI gave the sensitive content to an unsecure third party. Its a risky move, so they have responsability, regardless of this being a standard behaviour.

[-] Wispy2891@lemmy.world 52 points 5 days ago

"WE didn't get hacked, we only gave all the data of our customers to a third party and THEY got hacked!"

[-] ArmchairAce1944@discuss.online 10 points 5 days ago* (last edited 5 days ago)
[-] nomorebillboards@lemmy.world 3 points 5 days ago* (last edited 5 days ago)

Why the hell would this all be a part of their plan

[-] ArmchairAce1944@discuss.online 5 points 5 days ago

Side hustle? Money on the side.

[-] ripcord@lemmy.world 2 points 5 days ago

Why in the world would that be part of their plan

[-] MalReynolds@piefed.social 5 points 5 days ago* (last edited 5 days ago)

It's the limit our legal liability and PR damage because we're cheaping out on cybersecurity plan, not uncommon.

load more comments (1 replies)
[-] Lucidlethargy@sh.itjust.works 1 points 5 days ago

"They asked real nice. They deserved your data, you filthy little rubes."

[-] straycatstrut@discuss.tchncs.de 53 points 5 days ago

I was taught at an impressionable age that the only winning move was not to play. Advice that has not failed me in some 42 years now. Thanks Joshua!

[-] ArmchairAce1944@discuss.online 10 points 5 days ago

Turns out you fucking CAN win.

[-] wavebeam@lemmy.world 8 points 5 days ago

Fuckin Mathew Broderick teaching us all a good lesson about thermonuclear war

[-] RavuAlHemio@lemmy.world 56 points 6 days ago

I guess all their cybersecurity measures were implemented by ChatGPT…

[-] mjr@infosec.pub 11 points 5 days ago* (last edited 5 days ago)

Vibe coding at its finest? Maybe they were implemented by Copilot and it saw an opportunity to hurt a rival AI?

[-] Lucidlethargy@sh.itjust.works 1 points 5 days ago
[-] JasonDJ@lemmy.zip 33 points 5 days ago

I honest to fucking God don't understand how cybersec is so fucking bad that there are so many damn data breaches that I lost count

Really? It's hard to understand?

Dude it's a fucking arms race between cyber security teams and attackers.

And there's more money in attacking than there is in defending. Defending is an expense. Attacking is almost entirely profit

And some attackers are backed by nation-states.

Attackers only have to get through once. Defense has to work 100% of the time.

[-] ArmchairAce1944@discuss.online 3 points 5 days ago

Don't they discover them and track down who they are? If a group of jackass hackers (self taught or otherwise) are always trying to break into a system and failing a few times before getting in, wouldn't the defenders be able to trace something about where those people are? Like is it really that dumb? Are defenders really a bunch of keystone kops driving around in circles and bumping into walls?

[-] boatswain@infosec.pub 10 points 5 days ago

Username checks out

[-] null@piefed.nullspace.lol 9 points 5 days ago

wouldn’t the defenders be able to trace something about where those people are?

Not necessarily or trivially.

[-] CentipedeFarrier@piefed.social 8 points 5 days ago

Even if they did track them down, then what?

The world is huge, it’s unlikely that a particular attacker is going to be from the same country, so how are they going to do anything about it, really?

The victim can report to the government local to the hackers, but that local government is under no real obligation to do anything about it.

[-] mjr@infosec.pub 3 points 5 days ago

The victim can report to the government local to the hackers, but that local government is under no real obligation to do anything about it.

And given this, why would most companies keep paying their defenders to hunt them down once the trail seems to end in a foreign country?

Defence is seen as a cost that reduces other costs, rather than something which will pay back, so I suspect it only happens if the company doesn't have other work for the defenders to do (rare) so they might as well work on this as be paid to do nothing, if they think the attackers may return so they want to learn as much as possible about them for future defence (depends on what they did and who they it seems they may be), or if the government where the company is based steps in to fund the hunt for some reason (maybe political).

load more comments (3 replies)
[-] TachyonTele@piefed.social 8 points 5 days ago
[-] ArmchairAce1944@discuss.online 2 points 5 days ago

Its actually even stupider and more destructive than the movies.

[-] TachyonTele@piefed.social 1 points 5 days ago

What are you talking about?

[-] ripcord@lemmy.world 6 points 5 days ago

Are you like 12...?

[-] unpossum@sh.itjust.works 4 points 5 days ago

Username checks out, I guess

[-] 4am@lemmy.zip 26 points 5 days ago

This is the hackers fault for violating the OpenAI TOS.

[-] Anarki_ 19 points 5 days ago* (last edited 5 days ago)

⢀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⣠⣤⣶⣶ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⢰⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⣀⣀⣾⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⡏⠉⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿ ⣿⣿⣿⣿⣿⣿⠀⠀⠀⠈⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⠉⠁⠀⣿ ⣿⣿⣿⣿⣿⣿⣧⡀⠀⠀⠀⠀⠙⠿⠿⠿⠻⠿⠿⠟⠿⠛⠉⠀⠀⠀⠀⠀⣸⣿ ⣿⣿⣿⣿⣿⣿⣿⣷⣄⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠠⣴⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⢰⣹⡆⠀⠀⠀⠀⠀⠀⣭⣷⠀⠀⠀⠸⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀⠀⠈⠉⠀⠀⠤⠄⠀⠀⠀⠉⠁⠀⠀⠀⠀⢿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⢾⣿⣷⠀⠀⠀⠀⡠⠤⢄⠀⠀⠀⠠⣿⣿⣷⠀⢸⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⡀⠉⠀⠀⠀⠀⠀⢄⠀⢀⠀⠀⠀⠀⠉⠉⠁⠀⠀⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠈⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿

Clanker wankers will say they have nothing to hide anyway.

[-] scytale@piefed.zip 14 points 5 days ago* (last edited 5 days ago)

IMO the problem with companies doing “fast” technology (i.e. AI) do so by pushing security aside to get things through the pipeline and into production as quickly as possible. Security has always been a “blocker” to development teams because it slows them down with all the, you know, requirements to make a product/application secure. Unless you have security-minded leads or a security representative in the C-suite (i.e. CISO) who has significant influence, half-baked and insecure products will continuously be pushed out.

[-] northernlights@lemmy.today 4 points 5 days ago

Yep and then devs solved the problems of these damn IT sec people getting in the way and created "SecDevOps". Oh it's lean and Agile and everything but it's dev and sec and production all in the same bucket with all the well known problems of pushing things too fast and not checking or testing enough (see CloudFlare etc).

[-] Lucidlethargy@sh.itjust.works 7 points 5 days ago

Lol.

I'm so sorry, I should care...

In my defence: nah.

[-] drascus@sh.itjust.works 7 points 5 days ago

The worst part to me is that so many companies use third parties to process parts of things that it's like you give data to one company and they give your data to like 10 other companies and before you know it your information has been breached multiple times over from the same starting point.

[-] fort_burp@feddit.nl 6 points 5 days ago

OpenAI claims that ChatGPT users were unaffected, with chat content, API usage, passwords, payment details, and government IDs remaining safe.

Ah yes, OpenAI, the trustworthy company run by trustworthy folks. I'm sure they just need $300 bn to re-safeguard your personal data.

[-] UltraMagnus0001@lemmy.world 3 points 5 days ago

OpenAI claims that ChatGPT users were unaffected, with chat content, API usage, passwords, payment details, and government IDs remaining safe. However, users of OpenAI's API interfaces at platform.openai.com have seen a variety of data exposed in this latest breach.

[-] truthfultemporarily@feddit.org 6 points 5 days ago

There is no perfect system, if you try hard enough you can get into almost anything.

[-] raspberriesareyummy@lemmy.world 5 points 5 days ago

And nothing of value was lost... Fucking morons, every single one if them...

[-] ArmchairAce1944@discuss.online 2 points 5 days ago

Is there a single person online who hasn't been victimized by a data breach yet?

[-] raspberriesareyummy@lemmy.world 2 points 5 days ago

I commented on this particular one...

[-] olafurp@lemmy.world 3 points 5 days ago

Is it really so hard to self host the analytics with an open source analytics solution? I don't know why people at any scale of more than 15 devs would want that kind of security risk.

[-] drascus@sh.itjust.works 2 points 5 days ago

Lazy and cheap.

[-] morto@piefed.social 3 points 5 days ago

I just realized I never deleted the account I created a couple years ago to try it, before knowing all the harms of ai, and realizing it wasn't worth it. They claim that chatgpt users weren't affected, but we can never trust them. Well, at least I remembered to delete my account now.

[-] ArmchairAce1944@discuss.online 4 points 5 days ago

I didnt discuss anything dicey or sensitive or even too personal, and i never used a paid service. But honestly all these data breaches are just... fucked. Especially with governments increasingly passing ID laws that will result in even more sensitive information being leaked (and that already happened in the UK).

For some reason hearing about this breach pissed me off even more than usual.

[-] Nanook@lemmy.zip 2 points 5 days ago
load more comments
view more: next ›
this post was submitted on 27 Nov 2025
442 points (100.0% liked)

World News

51022 readers
2357 users here now

A community for discussing events around the World

Rules:

Similarly, if you see posts along these lines, do not engage. Report them, block them, and live a happier life than they do. We see too many slapfights that boil down to "Mom! He's bugging me!" and "I'm not touching you!" Going forward, slapfights will result in removed comments and temp bans to cool off.

We ask that the users report any comment or post that violate the rules, to use critical thinking when reading, posting or commenting. Users that post off-topic spam, advocate violence, have multiple comments or posts removed, weaponize reports or violate the code of conduct will be banned.

All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users.


Lemmy World Partners

News !news@lemmy.world

Politics !politics@lemmy.world

World Politics !globalpolitics@lemmy.world


Recommendations

For Firefox users, there is media bias / propaganda / fact check plugin.

https://addons.mozilla.org/en-US/firefox/addon/media-bias-fact-check/

founded 2 years ago
MODERATORS