Can ChatGPT leak your data? It already has — once, publicly, and by accident. On March 20, 2023, ChatGPT users began noticing something unsettling in their sidebar: conversation titles that weren’t theirs. Descriptions of other people’s chats — other people’s questions, projects, and problems — were appearing in strangers’ accounts. OpenAI took ChatGPT offline for several hours the same day.
The postmortem, published days later, traced the incident to a bug in an open-source library (the redis-py client) that OpenAI used for caching. Under a specific pattern of canceled requests, connections could return data belonging to a different user.
It Was Worse Than Chat Titles
The visible symptom was other users’ conversation titles. The fuller impact, disclosed by OpenAI after investigation, reached payment data: during a roughly nine-hour window, the same bug made it possible for some active ChatGPT Plus subscribers to see another subscriber’s first and last name, email address, payment address, credit card type with the last four digits, and card expiration date. OpenAI estimated about 1.2% of Plus subscribers active during the window were affected. Full card numbers were never exposed, and the company notified affected users.
The reaction was immediate and institutional. Within days, Italy’s data protection authority temporarily banned ChatGPT outright, citing the breach among broader concerns — the first such action by a Western regulator against a major AI service. Service in Italy resumed only after OpenAI made changes weeks later.
Why This Incident Still Matters
The March 2023 leak is not a story about OpenAI being careless. It’s a story about what it means to send data to any external service. OpenAI found the bug, fixed it, disclosed it, and notified users — responsible handling by any standard. The lesson is structural, not moral:
- Your prompt lives on infrastructure you don’t control. Once submitted, its confidentiality depends on someone else’s caching layers, dependency choices, and incident response — forever outside your audit scope.
- Bugs don’t respect data sensitivity. The Redis bug didn’t distinguish between a user asking for a pasta recipe and one pasting quarterly financials. Whatever was there was what leaked.
- “We don’t train on your data” is not the whole threat model. Most enterprise AI-risk conversations fixate on training-data retention. The March incident involved zero training — just an ordinary software bug in a system holding your content.
- Recall is impossible. Nothing exposed in that window could be un-exposed. The only variable organizations actually control is what enters the prompt in the first place.
Every AI provider — OpenAI, Anthropic, Google, and the hundreds of smaller tools employees use daily — runs software, and software has bugs. Some providers will handle incidents as well as OpenAI did. Some will not. Some will never know they had one.
The Enterprise Math
For an individual, the March 2023 incident meant a chat title or, at worst, partial billing details exposed to a stranger. For an organization whose employees paste customer records, credentials, source code, and deal documents into AI tools, the same class of incident means those materials sitting in systems that can fail in ways nobody anticipated.
This is why “which AI vendor do we trust?” is the wrong question, or at least an incomplete one. The complete question is: what of ours is inside these systems when something goes wrong? An organization that keeps secrets, credentials, and regulated data out of prompts is largely indifferent to the next provider incident. An organization that doesn’t is betting its confidential information on the uptime of other people’s bug trackers.
How Blacksight Bounds the Blast Radius
Blacksight exists to make that first kind of organization possible without banning AI. Its browser extension and endpoint agent scan every prompt locally — on the employee’s device, before submission — and block or redact sensitive content: credentials, customer PII, financial records, source code, health data, and custom patterns you define. What never enters the prompt can never be exposed by the provider’s next incident.
The architecture mirrors the lesson of the leak itself: Blacksight never receives your prompt text either. Scanning happens on-device; the dashboard records only verdicts and metadata. Protecting your data from third-party infrastructure by routing it through different third-party infrastructure would miss the point entirely.
Start free on 5 devices — and make the next provider incident someone else’s problem.
Frequently Asked Questions
Has ChatGPT ever had a data breach?
Yes. On March 20, 2023, a caching bug exposed some users’ conversation titles to other users, and during a ~9-hour window made partial payment details (name, email, billing address, card last four and expiry) of roughly 1.2% of active ChatGPT Plus subscribers viewable by others. OpenAI took the service offline, fixed the bug, and notified affected users.
Is it safe to put confidential company data into ChatGPT?
Treat anything submitted as outside your control: retained under provider policies you don’t audit, on infrastructure that can fail. The March 2023 incident proved exposure can happen without any malice or training involvement — through an ordinary bug. Safe usage means keeping confidential data out of prompts, enforced automatically rather than by hoping.
What should a company do to protect data used with AI tools?
Adopt prompt-level DLP: real-time scanning that blocks or redacts sensitive categories before submission, an audit trail of AI interactions, and policies by data class. Provider-side assurances help, but the only control you fully own is what leaves your devices.