What happened in the March 2023 ChatGPT data exposure

On March 20, 2023, a software bug let some ChatGPT users see small pieces of other users’ information. This included chat titles, sometimes the first message of a new chat, and for some paying subscribers, their name, email, payment address and partial card details. It was not a hack. It was an ordinary bug, and it is a useful reminder that anything you type into a cloud AI tool lives on someone else’s systems.

Everything below comes from OpenAI’s own public account of the incident, published on March 24, 2023. When we checked the original page on 2026-10-27 it returned an error, so we read an archived copy. We have not added details from other reports. Keep in mind that this is the vendor describing its own problem.

What happened

On Monday, March 20, 2023, OpenAI found a bug in ChatGPT and took the service offline.

While the bug was active, some users could see information that belonged to other people who were using ChatGPT around the same time. OpenAI later brought the service back. Chat history came back after that, except for a few hours of history that were lost.

People often call this the ChatGPT data breach. “Data exposure” is the more accurate term. Nobody broke in. The system showed the wrong data to the wrong person.

What was exposed and to whom

According to OpenAI, there were 2 kinds of exposure: chat information and payment information.

What could be seen	Whose it was	When
Titles from another user’s chat history	Another active ChatGPT user	While the bug was active
The first message of another user’s new conversation (in some cases)	Another user who was active around the same time	While the bug was active
Name, email, payment address, card type, last 4 digits of the card, card expiration date	Another active ChatGPT Plus subscriber	Between 1 a.m. and 10 a.m. Pacific time on March 20

How payment details could be seen

OpenAI described 2 ways someone could have seen another subscriber’s payment details during that 9-hour window:

• Misdirected emails. Some subscription confirmation emails sent in that window went to the wrong people. Those emails showed another user’s card type and the last 4 digits of the card number.
• The account page. A user who clicked “My account” and then “Manage my subscription” during that window might have seen another active Plus subscriber’s details.

What was not exposed

OpenAI says full credit card numbers were never exposed. Only the last 4 digits appeared.

How many people

OpenAI says the bug may have made payment-related information visible for 1.2% of ChatGPT Plus subscribers who were active during the 9-hour window. It also says it believes the number of people whose data was actually shown to someone else is “extremely low” in its own wording. The post gives no total number of people.

OpenAI also says exposure before March 20 was possible, but that it had not confirmed any cases.

The cause in plain words

ChatGPT stored some user information in a cache, a fast short-term store that saves the system from looking things up again each time. To talk to that cache, OpenAI used a free, open-source software library that many companies use.

That library had a bug. Here is the simple version:

1. Requests from many users shared the same connection to the cache.
2. If a request was canceled at one particular moment, that shared connection could be left in a broken state.
3. The next request on that connection, from a different user, could then receive leftover data. Sometimes that leftover data belonged to someone else.

The bug existed before March 20, but it rarely caused trouble. At 1 a.m. Pacific time that day, OpenAI deployed a change to its servers that led to a sharp rise in canceled requests. More canceled requests meant more broken connections, and the problem became visible.

A rough everyday comparison: picture a mail room where a clerk is interrupted halfway through filling an envelope. The next clerk picks up the same tray and sends the half-filled envelope to the wrong address. Nobody stole anything. A routine process broke under pressure.

What OpenAI says it did afterwards

Based on its post, OpenAI:

• Took ChatGPT offline once it found the bug.
• Sent a fix to the people who maintain the open-source library, who then fixed the bug.
• Notified users whose payment information may have been exposed.
• Added extra checks so that data coming from the cache matches the user who asked for it.
• Went through its logs to confirm that messages are visible only to the right user.
• Compared data from different sources to identify which users were affected.
• Improved its logging.
• Made its cache system more resilient under very heavy load.
• Restored the service and later restored chat history, apart from a few hours.

OpenAI said it was confident there was no ongoing risk to users’ data, and it apologized. We have no independent way to check these claims. They are what the vendor reported.

What this teaches a small organization

These are our lessons for small teams. They are advice, not claims about how OpenAI runs its systems.

A bug can expose your data as easily as an attacker can

When people ask “is ChatGPT safe,” they usually picture hackers. This incident came from a normal software change meeting a hidden flaw. Any text you type into a cloud AI tool is stored on the vendor’s systems, and any software can have bugs. Plan for that.

Be careful what goes into chat tools

In this case, the chat content that leaked was limited to titles and some first messages. Even so, chat titles often summarize what a conversation is about. A title like “Draft letter about a client’s eviction case” says a lot on its own.

Keep restricted information out of chat tools unless your organization has approved it. For a non-profit, that usually means:

• Names and details of clients, donors or beneficiaries
• Health, legal, immigration or financial information about individuals
• Staff personnel matters
• Passwords, account numbers and grant application details marked confidential

Choose plans with admin controls and short retention

The less a tool keeps, the less a bug can expose. Where you can, use plans that let an administrator manage accounts and set how long chats are kept. Our glossary entry on data retention explains the idea in more detail.

Judge vendors by how they handle incidents

Every vendor will have problems at some point. What matters is what they do next. A public post that explains what happened, who was affected, the cause and the fixes is a good sign. Silence or vague statements are not. Our list of AI vendor assessment questions includes questions about incident handling that you can ask before you sign up.

Have a plan for your side

When a vendor reports an incident, the vendor handles its systems. You still need to handle yours: working out what your staff put into the tool and whether anyone needs to be told. Our course module on handling an AI incident walks through this, and the glossary explains what counts as an AI incident.

What to do now

You can do these steps this week, even with no IT staff.

1. List the AI chat tools your team uses. Ask staff and volunteers directly. Include personal accounts used for work.
2. Write down what must stay out. One short paragraph is enough: the kinds of data that should never be typed into a chat tool.
3. Check your plan and settings. For each tool, find out whether you have admin controls and how long chats are kept. See our ChatGPT tool profile for what ChatGPT does with your data today.
4. Clear out old chats that hold sensitive material. If staff have already pasted restricted data into a tool, delete those chats where the tool allows it.
5. Name an incident contact. Choose one person who reads vendor security notices and decides what to do next.
6. Write 3 questions for future incidents. Which accounts did we use? What was in them? Who might we need to tell?

Frequently asked questions

Was this a hack?

No. OpenAI describes a bug in an open-source library it used, made worse by a server change that caused many canceled requests. No attacker was involved in its account. The data reached the wrong people because the system mixed up responses.

Were full credit card numbers exposed?

OpenAI says full credit card numbers were never exposed. What some people could see was the card type, the last 4 digits, the expiration date, and the subscriber’s name, email and payment address. That is still personal information, so it is worth taking seriously.

Is ChatGPT safe to use now?

OpenAI says the bug was fixed and that it added checks to stop cached data from going to the wrong user. No online tool is risk-free, so the safer question is what you put into it. Keep restricted data out, use admin controls where you can, and check our ChatGPT tool profile for the current picture.

What should we do if a vendor tells us our data was exposed?

Read the notice carefully and write down what was exposed and when. Then check what your staff stored in the affected accounts and decide whether clients, donors or others need to be told. Our course module on handling an AI incident gives a step-by-step approach.