ChatGPT leaked users' data, and nobody hacked it
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A 2023 post-mortem of the ChatGPT data exposure traces it to a redis-py bug, not an attack. According to OpenAI, a server change on 20 March caused Redis request cancellations. A cancelled request left its response in a pooled connection, and the next request could receive it. Chat titles and, for 1.2% of active Plus subscribers, billing details may have been visible. The redis-py fixes were revised twice. OpenAI added checks that cached data matches the requesting user. Most details rest on OpenAI's own account.