ChatGPT leaked users' data, and nobody hacked it
Comments on “ChatGPT leaked users' data, and nobody hacked it”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A 2023 post-mortem of the ChatGPT data exposure traces it to a redis-py bug, not an attack. According to OpenAI, a server change on 20 March caused Redis request cancellations. A cancelled request left its response in a pooled connection, and the next request could receive it. Chat titles and, for 1.2% of active Plus subscribers, billing details may have been visible. The redis-py fixes were revised twice. OpenAI added checks that cached data matches the requesting user. Most details rest on OpenAI's own account.
Why it ranked
No. 3 of 155 with a score of 0.76. The panel rated it highest on substantiated (0.92) and new information (0.91), lowest on significance (0.65).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-sourced post-mortem of a 2023 ChatGPT data exposure caused by a redis-py async cancellation bug; practical lessons for builders, though the incident is older and not new in the last-7-day list beyond the Garante follow-up.}
- AI judgeJudge 3gpt-5.6-luna
- A well-sourced technical postmortem explains a real cross-user data leak, pooled-connection failure, dependency history, mitigations, and regulatory aftermath. It offers broadly useful infrastructure and security lessons, though the incident is historical rather than current.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.76total under rubric v2.2
- Significance0.65
- Reader interest0.82
- Audience breadth0.66
- Practical relevance0.83
- Substantiated0.92
- Technical depth0.86
- New information0.91
- Counts against: Promotional0.03
- Counts against: Overclaim0.11
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.64 | 0.60 | 0.72 | 0.65 | 0.12 | +0.24 | +0.157 |
| Reader interest | 0.70 | 0.85 | 0.90 | 0.82 | 0.20 | +0.26 | +0.212 |
| Audience breadth | 0.60 | 0.70 | 0.68 | 0.66 | 0.10 | +0.13 | +0.086 |
| Practical relevance | 0.88 | 0.80 | 0.82 | 0.83 | 0.08 | +0.22 | +0.183 |
| Substantiated | 0.91 | 0.90 | 0.94 | 0.92 | 0.04 | +0.05 | +0.046 |
| Technical depth | 0.89 | 0.85 | 0.86 | 0.86 | 0.04 | +0.05 | +0.043 |
| New information | 0.91 | 0.85 | 0.98 | 0.91 | 0.13 | +0.05 | +0.046 |
| Promotional | 0.04 | 0.03 | 0.01 | 0.03 | 0.03 | −0.19 | −0.005 |
| Overclaim | 0.20 | 0.10 | 0.04 | 0.11 | 0.16 | −0.11 | −0.012 |
| Sum of contributions | +0.756 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.756 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/3/"><img src="https://rubric.hrih.si/badge/2026-10-28/3.svg" alt="Ranked #3 on Rubric, 28 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 2 matches source · 6 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
OpenAI says the payment-related information of 1.2% of ChatGPT Plus subscribers active during a nine-hour window may have been visible to another user.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “OpenAI says the payment-related information of 1.2% of ChatGPT Plus subscribers active during a nine-hour window may have been visible to another user”
The source says No passage could be compared.
Source cited by the article: openai.com/index/march-20-chatgpt-outage
Couldn’t checkCausal conclusion
OpenAI introduced a change to its server at 1 a.m. Pacific time on 20 March 2023 that caused a spike in Redis request cancellations, giving each connection a small probability of returning bad data.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “At 1 a.m. Pacific time on Monday, March 20, we inadvertently introduced a change to our server that caused a spike in Redis request cancellations”
The source says No passage could be compared.
Source cited by the article: openai.com/index/march-20-chatgpt-outage
Couldn’t checkCausal conclusion
A request cancelled midway in the redis-py asyncio client corrupted the pooled connection, so the next unrelated request could receive another user's leftover data.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the connection thus becomes corrupted and the next response that’s dequeued for an unrelated request can receive data left behind in the connection”
The source says No passage could be compared.
Source cited by the article: openai.com/index/march-20-chatgpt-outage
Matches sourceDate
A developer opened redis-py issue #2624 on 17 March 2023, three days before the incident, reporting that cancelling an async Redis command leaves the connection in an unsafe state.
The cited source says the same thing.
The article says “On 17 March 2023, three days earlier, a developer opened issue #2624 on redis-py”
The source says “closed, opened 2023-03-17 by drago-balto”
Source cited by the article: github.com/redis/redis-py/issues/2624
Couldn’t checkVersion
The redis-py maintainers merged fix #2641 on 22 March, released as 4.5.3, and the reporter said the race condition could still be reproduced on 4.5.3.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The maintainers merged a fix, #2641, on 22 March, released as 4.5.3”
The source says No passage could be compared.
Source cited by the article: github.com/redis/redis-py/pull/2641
Couldn’t checkVersion
Wider fix #2666 shipped in redis-py 4.5.4 on 29 March, and was later undone by #2695, released in 4.5.5 on 8 May 2023.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A wider fix, #2666, wrapped commands “with a shield” and shipped in 4.5.4 on 29 March”
The source says No passage could be compared.
Source cited by the article: github.com/redis/redis-py/pull/2666
Couldn’t checkQuote
CVE-2023-28858 notes it was initially created in response to reports about ChatGPT, and CVE-2023-28859 covers data leakage across AsyncIO connections in general.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The first, CVE-2023-28858, notes it “was initially created in response to reports about ChatGPT”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
Matches sourceNumber
Italy's Garante announced a fine of 15 million euros in December 2024, noting OpenAI had not notified it of the March 2023 breach.
The cited source says the same thing.
The article says “In December 2024 the Garante announced a fine of 15 million euros, noting among other things that OpenAI had not notified it of the breach suffered in March 2023”
The source says “The Data Protection Authority imposed a fine of EUR 15 million on OpenAI, which was also calculated taking into account the company’s cooperative attitude”
Source cited by the article: garanteprivacy.it/home/docweb/-/docweb-display/print/10085432
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 5 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.