Massive OmniGPT Breach Exposes 300 Million Private Messages and Sensitive User Data In one of the most severe AI platform breaches to date, OmniGPT, a popular chatbot aggregator, suffered a catastrophic data exposure affecting 300,000 users. The breach, first disclosed by cybersecurity firm Hackread, revealed over 300 million private messages, along with uploaded files, email addresses, phone numbers, and payment information. The incident was uncovered on February 9, when a threat actor known as "Gloomer" posted the stolen data on BreachForums, a notorious dark web marketplace. ### Scope and Impact of the Breach The leaked dataset included: - 30,000 user email addresses, phone numbers, and API keys - Full chat logs from interactions with AI models (GPT-4, Gemini, Claude, Midjourney) - Uploaded files containing proprietary business documents, medical records, personal identification, and financial data - Metadata such as timestamps, user identifiers, and model query details Security researchers analyzing the breach found evidence of deep backend access, suggesting either a SQL injection attack or exploitation of a misconfigured API endpoint. The inclusion of API keys is particularly concerning, as they could allow attackers to impersonate users or access underlying AI services at OmniGPT’s expense. ### OmniGPT’s Broken Security Promises OmniGPT markets itself as a secure, enterprise-grade AI aggregation platform, offering unified access to multiple large language models (LLMs) under a single subscription. Despite claims of encrypted messaging and robust security, the breach exposed fundamental vulnerabilities in its infrastructure. The platform’s failure to protect user data including sensitive files uploaded for AI analysis has left users at risk of identity theft, financial fraud, and corporate espionage. ### The Unique Risks of AI Chat Logs Unlike traditional data breaches, the OmniGPT leak includes full conversation histories, which often contain highly sensitive information users share with AI assistants. These interactions may involve: - Confidential business documents (contracts, code, financial records) - Personal medical and legal discussions - Private struggles and personal details The breach highlights a growing security gap: AI platforms accumulate vast amounts of sensitive data, yet many lack the security frameworks to protect it. Users often treat AI chatbots as private, low-risk tools, unaware that their conversations and uploads may be stored insecurely and targeted by cybercriminals. ### OmniGPT’s Silence Raises Concerns As of this report, OmniGPT has not issued a public statement acknowledging the breach or outlining remediation steps. This lack of transparency violates data breach notification laws in multiple jurisdictions, including the EU’s GDPR and various U.S. state regulations. Without official confirmation, affected users remain in the dark about which data was compromised and what protective measures to take. ### A Growing Trend of AI Platform Vulnerabilities The OmniGPT breach is part of a wider pattern of security failures in AI services. Recent incidents include: - OpenAI’s 2023 bug exposing ChatGPT users’ chat histories and payment data - Prompt injection attacks allowing extraction of training data and private conversations - Third-party AI aggregators becoming high-value targets due to their concentration of sensitive data These platforms face unique security challenges, as they must integrate multiple AI services, store vast datasets, and maintain complex APIs often with limited security resources compared to major AI providers. ### Broader Implications for AI Security The breach underscores a critical tension in the AI industry: the same features that make AI tools useful processing sensitive data also make them prime targets for cyberattacks. As AI adoption grows, so does the volume of confidential information flowing through these systems, increasing the incentive for attackers. Regulators are taking notice. The EU’s AI Act and U.S. FTC scrutiny may soon impose stricter data security and transparency requirements on AI platforms. For now, the OmniGPT breach serves as a stark reminder: AI chat interfaces are not casual tools they are data repositories, and their security failures can have devastating consequences.