I honest to fucking God don't understand how cybersec is so fucking bad that there are so many damn data breaches that I lost count. I had a few accounts on chatgpt (that I dont use anymore) but they are all compromised now...

Just what the fuck is this shit? Are they done by lone actors or cybercrime gang? Or are they state actors or state-backed actors? Or are they inside jobs to allow the company to sell data illegally to make more money? Flock has admitted to using data from data breaches to their system.

You also notice how rarely you hear about cybercriminals getting caught? It's almost like if you take even a minor bit of opsec you can get away with anything.

all 16 comments

sorted by: hot top controversial new old
[–] 9 points 11 months ago (2 children)

Good Security and record Profits are antithetical Ideals.

  • source
  • hideshow 2 child comments
  • [–] 8 points 11 months ago (5 children)

    Never use emails addresses tied to secure services such as banking or shopping or gov services for any other purpose.

    Create email addresses through various services for various purposes.

    Banking, google services like YouTube, social media, personal - friends and family, and of course an account for porn.

    Don't use your real name or any actually useful when creating an email addreas

    Use email relays or anon email that creates random addresses and forwards to your email.

    Use proton mail and have up to 10 alias accounts at a time.

    Use temp email addresses.

    Compartmentalize your online accounts and data to minimize exposure and damages.

  • source
  • hideshow 5 child comments
  • [–] 4 points 11 months ago (2 children)

    Not gonna happen. I would need at least 50 email accounts to compartmentalize everything I do online. Honestly probably a lot more than that. Maintaining that many accounts becomes a security risk in itself.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 11 months ago* (1 child)

    If you own a domain you can redirect all to a single inbox, so there is nothing to manage. You register at randomsite? randomsite@yourdomain.com it is. Every account gets a unique email address, all emails end up in the same inbox, and there is nothing to do, you have infinite addresses.

    And you never share your actual Proton address where it all ends up.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 11 months ago

    If I understand correctly this impacted users doing API stuff so as a general user I'm unaffected, which is a relief. Didn't have en e-mail, at least.

    I like some of these ideas, so that if you are a target of a leak they don't get everything and easy access to other things. At some point people are going to stop focusing on security for convenience sake. So what's the cutoff, financial institutions get different emails/usernames/passwords? Government sites? Medical? Etc.

  • source
  • parent
  • [–] 7 points 11 months ago

    They're so worried about getting into AI they don't care about the environmental impact, the economic impact, security, or whether it even works.

  • source
  • [–] 14 points 11 months ago* (last edited 11 months ago) (2 children)

    It’s almost like if you take even a minor bit of opsec you can get away with anything.

    Most of those cyber criminals sit outside of western jurisdiction. That's why they are "safe" from arrests. Good luck enforcing an arrest warrant in Russia, India, China or North Korea.

  • source
  • hideshow 2 child comments
  • [–] [S] 3 points 11 months ago (1 child)

    I guess that makes sense. I guess if those hackers were in North America we'd see some arrests?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 11 months ago

    And we do! Usually it's American/British kids that get caught after going after high profile targets because they're kids and they're dumb. Some of the more well known groups (e.g. Scattered Spider, The Com) specifically recruit minors to do the hands on keyboard operations because they're less likely to get time than adults. Most resourced hackers are not stupid enough to launch operations against Western organizations from countries with extradition agreements.

    https://cybernews.com/cybercrime/scattered-spider-mgm-hackers-indictment/

    https://krebsonsecurity.com/2025/07/uk-charges-four-in-scattered-spider-ransom-group/

    https://www.bleepingcomputer.com/news/security/scattered-spider-hacker-gets-sentenced-to-10-years-in-prison/

  • source
  • parent
  • [–] 3 points 11 months ago

    I should start a company that instructs companies on how to avoid all these data breaches: stop giving 3rd party access to your customers data.

  • source
  • [–] 2 points 11 months ago

    Nice! Would be nice if at least few idiots would stop using this planet destroying shit.

  • source
  • [–] 2 points 11 months ago* (last edited 11 months ago)

    Inside job most likely went down like: "oh noes mr data broker, I have to step away for a minute, so by all means do not forget to take all that money you've set on my desk next to all that data I've left unsecured and unattended!" - OpenAI is founded as a company based on stolen IP. Altman belongs in prison.

  • source
  • 57 comments in c/world@lemmy.world view that post
    [–] 80 points 11 months ago (6 children)

    confirm[ing] that a ton of user data has been exposed owing to a breach in a third-party web analytics tool called Mixpanel.

    Important detail to know before commenting: it was Mixpanel analytics apparently that was breached and not ChatGPT itself.

    Another reason to have Firefox strict privacy mode turned on along with uBlock and Disconnect though :)

  • source
  • hideshow 6 child comments
  • [–] 27 points 11 months ago (1 child)

    analytics tools often have full access to everything on the page so this might as well be comparable to a breach of chatgpt itself

  • source
  • parent
  • hideshow 1 child comment
  • [–] 11 points 11 months ago

    For sure, yeah. When I joined my current company that provides a web service, I was blown away by how much is recorded. DataDog has a feature called RUM & Session Replay and I don't think people realise that every mouse movement, click, and interaction in general is recorded in enough detail that as a developer I can play back user sessions as if I were watching a screen recording. Mixed with the fact that it also captures as much identifying information as it can, it's pretty fucking creepy

  • source
  • parent
  • [–] 4 points 11 months ago* (2 children)

    Why is that an important detail? Does itbmakeba functional difference to me as a user? OpenAI collected the data and failed to secure it. Doesn't matter if a 3rd party was involved

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 11 months ago (1 child)

    It's important because none of OpenAI's software or databases were hacked. What was hacked was a service they use. As much as I dislike it, most companies that have a presence online use analytical services

    Doesn't matter if a 3rd party was involved

    involved isn't the correct term for this, or rather it's exact opposite direction. The 3rd party was hacked and as a result OpenAI data was leaked (along with any other companies using the platform that were affected)

    I bring it up because the nuance is important when I can predict people will jump on OpenAI to make claims of shoddy code. I hate OpenAI and Sam Altman but again, the nuance is important because this can happen to any company

    Get mad at the fact analytic companies collect enough data to cause this much of a mess if anything

  • source
  • parent
  • hideshow 1 child comment
  • [–] 51 points 11 months ago (7 children)

    "WE didn't get hacked, we only gave all the data of our customers to a third party and THEY got hacked!"

  • source
  • hideshow 7 child comments
  • [–] [S] 5 points 11 months ago (5 children)
  • [–] 1 point 11 months ago (2 children)

    Why in the world would that be part of their plan

  • source
  • parent
  • hideshow 2 child comments
  • [–] 36 points 11 months ago (2 children)

    If only they had asked ChatGPT to make them a foolproof security system. Human error, obviously

  • source
  • hideshow 2 child comments
  • [+] 54 points 11 months ago (2 children)
  • load more comments (1 reply)
    [–] 26 points 11 months ago

    This is the hackers fault for violating the OpenAI TOS.

  • source
  • [–] 17 points 11 months ago*

    ⢀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⣠⣤⣶⣶ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⢰⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⣀⣀⣾⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⡏⠉⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿ ⣿⣿⣿⣿⣿⣿⠀⠀⠀⠈⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⠉⠁⠀⣿ ⣿⣿⣿⣿⣿⣿⣧⡀⠀⠀⠀⠀⠙⠿⠿⠿⠻⠿⠿⠟⠿⠛⠉⠀⠀⠀⠀⠀⣸⣿ ⣿⣿⣿⣿⣿⣿⣿⣷⣄⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠠⣴⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⢰⣹⡆⠀⠀⠀⠀⠀⠀⣭⣷⠀⠀⠀⠸⣿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀⠀⠈⠉⠀⠀⠤⠄⠀⠀⠀⠉⠁⠀⠀⠀⠀⢿⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⢾⣿⣷⠀⠀⠀⠀⡠⠤⢄⠀⠀⠀⠠⣿⣿⣷⠀⢸⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⡀⠉⠀⠀⠀⠀⠀⢄⠀⢀⠀⠀⠀⠀⠉⠉⠁⠀⠀⣿⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠈⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿ ⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿

    Clanker wankers will say they have nothing to hide anyway.

  • source
  • [–] 56 points 11 months ago (2 children)

    I guess all their cybersecurity measures were implemented by ChatGPT…

  • source
  • hideshow 2 child comments
  • [–] 15 points 11 months ago* (1 child)

    IMO the problem with companies doing “fast” technology (i.e. AI) do so by pushing security aside to get things through the pipeline and into production as quickly as possible. Security has always been a “blocker” to development teams because it slows them down with all the, you know, requirements to make a product/application secure. Unless you have security-minded leads or a security representative in the C-suite (i.e. CISO) who has significant influence, half-baked and insecure products will continuously be pushed out.

  • source
  • hideshow 1 child comment
  • [–] 4 points 11 months ago

    Yep and then devs solved the problems of these damn IT sec people getting in the way and created "SecDevOps". Oh it's lean and Agile and everything but it's dev and sec and production all in the same bucket with all the well known problems of pushing things too fast and not checking or testing enough (see CloudFlare etc).

  • source
  • parent
  • [–] 30 points 11 months ago (13 children)

    I honest to fucking God don't understand how cybersec is so fucking bad that there are so many damn data breaches that I lost count

    Really? It's hard to understand?

    Dude it's a fucking arms race between cyber security teams and attackers.

    And there's more money in attacking than there is in defending. Defending is an expense. Attacking is almost entirely profit

    And some attackers are backed by nation-states.

    Attackers only have to get through once. Defense has to work 100% of the time.

  • source
  • hideshow 13 child comments
  • [+] [S] -13 points 11 months ago (12 children)

    Don't they discover them and track down who they are? If a group of jackass hackers (self taught or otherwise) are always trying to break into a system and failing a few times before getting in, wouldn't the defenders be able to trace something about where those people are? Like is it really that dumb? Are defenders really a bunch of keystone kops driving around in circles and bumping into walls?

  • source
  • parent
  • hideshow 12 child comments
  • [–] 8 points 11 months ago (4 children)

    Even if they did track them down, then what?

    The world is huge, it’s unlikely that a particular attacker is going to be from the same country, so how are they going to do anything about it, really?

    The victim can report to the government local to the hackers, but that local government is under no real obligation to do anything about it.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 11 months ago

    The victim can report to the government local to the hackers, but that local government is under no real obligation to do anything about it.

    And given this, why would most companies keep paying their defenders to hunt them down once the trail seems to end in a foreign country?

    Defence is seen as a cost that reduces other costs, rather than something which will pay back, so I suspect it only happens if the company doesn't have other work for the defenders to do (rare) so they might as well work on this as be paid to do nothing, if they think the attackers may return so they want to learn as much as possible about them for future defence (depends on what they did and who they it seems they may be), or if the government where the company is based steps in to fund the hunt for some reason (maybe political).

  • source
  • parent
  • [+] [S] -6 points 11 months ago (2 children)

    I find it difficult to believe that all attackers are necessarily from different countries. There was a breach in Canada some years ago when a bank lost tons of information and was hated for it. The hackers were in canada and it was on the news when they were finally caught. But that was an exception and not the rule.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 7 points 11 months ago

    OpenAI claims that ChatGPT users were unaffected, with chat content, API usage, passwords, payment details, and government IDs remaining safe.

    Ah yes, OpenAI, the trustworthy company run by trustworthy folks. I'm sure they just need $300 bn to re-safeguard your personal data.

  • source
  • [–] 6 points 11 months ago

    Lol.

    I'm so sorry, I should care...

    In my defence: nah.

  • source
  • [–] 6 points 11 months ago

    The worst part to me is that so many companies use third parties to process parts of things that it's like you give data to one company and they give your data to like 10 other companies and before you know it your information has been breached multiple times over from the same starting point.

  • source
  • [–] 3 points 11 months ago (1 child)

    Is it really so hard to self host the analytics with an open source analytics solution? I don't know why people at any scale of more than 15 devs would want that kind of security risk.

  • source
  • hideshow 1 child comment
  • [–] 3 points 11 months ago (1 child)

    I just realized I never deleted the account I created a couple years ago to try it, before knowing all the harms of ai, and realizing it wasn't worth it. They claim that chatgpt users weren't affected, but we can never trust them. Well, at least I remembered to delete my account now.

  • source
  • hideshow 1 child comment
  • [–] [S] 4 points 11 months ago

    I didnt discuss anything dicey or sensitive or even too personal, and i never used a paid service. But honestly all these data breaches are just... fucked. Especially with governments increasingly passing ID laws that will result in even more sensitive information being leaked (and that already happened in the UK).

    For some reason hearing about this breach pissed me off even more than usual.

  • source
  • parent
  • [–] 3 points 11 months ago

    OpenAI claims that ChatGPT users were unaffected, with chat content, API usage, passwords, payment details, and government IDs remaining safe. However, users of OpenAI's API interfaces at platform.openai.com have seen a variety of data exposed in this latest breach.

  • source
  • [–] 7 points 11 months ago (2 children)

    Never used AI online, never will. I played with a locally installed, air-gapped, Deepseek just to see what it was like, because I don't trust it at all. Meh.

    I don't get the hype.

    Y'all have fun with that, I'm going to avoid it as much as I can.

  • source
  • hideshow 2 child comments
  • [–] -1 points 11 months ago
    [–] -1 points 11 months ago (2 children)

    And nothing of value was lost... Fucking morons, every single one if them...

  • source
  • hideshow 2 child comments
  • 7 comments in c/fuck_ai@lemmy.world view that post
    [–] 33 points 11 months ago (2 children)

    I have always assumed that everything that I type into an LLM is guaranteed to be completely insecure, and entirely public. I would never, in a million years, put anything sensitive into an LLM, any account and password is unique.

    I mean, I figure whatever I type is going to be used as training data for the next iteration, and I assume anything that goes in, is retrievable to some degree.

  • source
  • hideshow 2 child comments
  • [–] 3 points 11 months ago

    If you use the API, they say they delete the data after 30 days and only keep it during those 30 days for security purposes (no training). Wouldn't be the first time a company lies about data use though.

    If you are using their app though, everything goes into the pot.

  • source
  • parent
  • [–] 21 points 11 months ago

    Here's what OpenAI claims has been exposed:

    * Names provided to accounts on platform.openai.com
    * Email addresses linked to the API accounts via platform.openai.com
    * "Coarse approximate location" determined by IP address and web browser
    * OS and browser type, as well as referring websites
    * Organizataions and user IDs saved into the API accounts
    
  • source
  • [–] 12 points 11 months ago

    These fuckwits

  • source
  • [–] 6 points 11 months ago

    users were unaffected, with chat content, API usage, passwords, payment details, and government IDs remaining safe.

    who needs a government ID to use chatgpt?

  • source
  • [–] 5 points 11 months ago

    Honestly good, fuck em. AI is already a threat to privacy so the users get to feel some immediate consequences of it!

  • source
  • 1 comment in c/databreaches@lemmy.zip view that post
    [–] 3 points 11 months ago

    OpenAI claims that ChatGPT users were unaffected, with chat content, API usage, passwords, payment details, and government IDs remaining safe.

    If they weren't so brain rotted from AI, they'd realize that those things aren't retained for shits and giggles in the first place...

    Everything you ever say to a chatbot is archived and associated with your profile. And the chatbot company owns it and can do whatever they want with it.

  • source