Users are waking up to discover OpenAI leaked their data this morning via a faulty third-party plugin. Here's what you need to know.

cross-posted from: https://discuss.online/post/31211123

I honest to fucking God don’t understand how cybersec is so fucking bad that there are so many damn data breaches that I lost count. I had a few accounts on chatgpt (that I dont use anymore) but they are all compromised now…

Just what the fuck is this shit? Are they done by lone actors or cybercrime gang? Or are they state actors or state-backed actors? Or are they inside jobs to allow the company to sell data illegally to make more money? Flock has admitted to using data from data breaches to their system.

You also notice how rarely you hear about cybercriminals getting caught? It’s almost like if you take even a minor bit of opsec you can get away with anything.

  • Caveman@lemmy.worldEnglish
    1·
    18 minutes ago

    Is it really so hard to self host the analytics with an open source analytics solution? I don’t know why people at any scale of more than 15 devs would want that kind of security risk.

  • Wispy2891@lemmy.worldEnglish
    22·
    4 hours ago

    “WE didn’t get hacked, we only gave all the data of our customers to a third party and THEY got hacked!”

  • straycatstrut@discuss.tchncs.deEnglish
    421·
    7 hours ago

    I was taught at an impressionable age that the only winning move was not to play. Advice that has not failed me in some 42 years now. Thanks Joshua!

  • NotSteve_@piefed.caEnglish
    57·
    8 hours ago

    confirm[ing] that a ton of user data has been exposed owing to a breach in a third-party web analytics tool called Mixpanel.

    Important detail to know before commenting: it was Mixpanel analytics apparently that was breached and not ChatGPT itself.

    Another reason to have Firefox strict privacy mode turned on along with uBlock and Disconnect though :)

    • Taldan@lemmy.worldEnglish
      1·
      39 minutes ago

      Why is that an important detail? Does itbmakeba functional difference to me as a user? OpenAI collected the data and failed to secure it. Doesn’t matter if a 3rd party was involved

  • morto@piefed.socialEnglish
    3·
    4 hours ago

    I just realized I never deleted the account I created a couple years ago to try it, before knowing all the harms of ai, and realizing it wasn’t worth it. They claim that chatgpt users weren’t affected, but we can never trust them. Well, at least I remembered to delete my account now.

    • ArmchairAce1944@discuss.onlineOPEnglish
      2·
      3 hours ago

      I didnt discuss anything dicey or sensitive or even too personal, and i never used a paid service. But honestly all these data breaches are just… fucked. Especially with governments increasingly passing ID laws that will result in even more sensitive information being leaked (and that already happened in the UK).

      For some reason hearing about this breach pissed me off even more than usual.

    • mjr@infosec.pubEnglish
      91·
      8 hours ago

      Vibe coding at its finest? Maybe they were implemented by Copilot and it saw an opportunity to hurt a rival AI?

  • JasonDJ@lemmy.zipEnglish
    331·
    8 hours ago

    I honest to fucking God don’t understand how cybersec is so fucking bad that there are so many damn data breaches that I lost count

    Really? It’s hard to understand?

    Dude it’s a fucking arms race between cyber security teams and attackers.

    And there’s more money in attacking than there is in defending. Defending is an expense. Attacking is almost entirely profit

    And some attackers are backed by nation-states.

    Attackers only have to get through once. Defense has to work 100% of the time.

    • ArmchairAce1944@discuss.onlineOPEnglish
      215·
      8 hours ago

      Don’t they discover them and track down who they are? If a group of jackass hackers (self taught or otherwise) are always trying to break into a system and failing a few times before getting in, wouldn’t the defenders be able to trace something about where those people are? Like is it really that dumb? Are defenders really a bunch of keystone kops driving around in circles and bumping into walls?

      • null@piefed.nullspace.lolEnglish
        8·
        7 hours ago

        wouldn’t the defenders be able to trace something about where those people are?

        Not necessarily or trivially.

      • CentipedeFarrier@piefed.socialEnglish
        91·
        7 hours ago

        Even if they did track them down, then what?

        The world is huge, it’s unlikely that a particular attacker is going to be from the same country, so how are they going to do anything about it, really?

        The victim can report to the government local to the hackers, but that local government is under no real obligation to do anything about it.

        • mjr@infosec.pubEnglish
          3·
          7 hours ago

          The victim can report to the government local to the hackers, but that local government is under no real obligation to do anything about it.

          And given this, why would most companies keep paying their defenders to hunt them down once the trail seems to end in a foreign country?

          Defence is seen as a cost that reduces other costs, rather than something which will pay back, so I suspect it only happens if the company doesn’t have other work for the defenders to do (rare) so they might as well work on this as be paid to do nothing, if they think the attackers may return so they want to learn as much as possible about them for future defence (depends on what they did and who they it seems they may be), or if the government where the company is based steps in to fund the hunt for some reason (maybe political).

        • ArmchairAce1944@discuss.onlineOPEnglish
          16·
          6 hours ago

          I find it difficult to believe that all attackers are necessarily from different countries. There was a breach in Canada some years ago when a bank lost tons of information and was hated for it. The hackers were in canada and it was on the news when they were finally caught. But that was an exception and not the rule.

          • CentipedeFarrier@piefed.socialEnglish
            6·
            6 hours ago

            I don’t recall saying all attackers were necessarily from different countries, because that’s not true at all. I said it’s unlikely they are from the same one, because statistically that is true.

  • scytale@piefed.zipEnglish
    11·
    8 hours ago

    IMO the problem with companies doing “fast” technology (i.e. AI) do so by pushing security aside to get things through the pipeline and into production as quickly as possible. Security has always been a “blocker” to development teams because it slows them down with all the, you know, requirements to make a product/application secure. Unless you have security-minded leads or a security representative in the C-suite (i.e. CISO) who has significant influence, half-baked and insecure products will continuously be pushed out.

    • northernlights@lemmy.todayEnglish
      3·
      5 hours ago

      Yep and then devs solved the problems of these damn IT sec people getting in the way and created “SecDevOps”. Oh it’s lean and Agile and everything but it’s dev and sec and production all in the same bucket with all the well known problems of pushing things too fast and not checking or testing enough (see CloudFlare etc).

  • TrackinDaKraken@lemmy.worldEnglish
    81·
    7 hours ago

    Never used AI online, never will. I played with a locally installed, air-gapped, Deepseek just to see what it was like, because I don’t trust it at all. Meh.

    I don’t get the hype.

    Y’all have fun with that, I’m going to avoid it as much as I can.