# ChatGPT leaked users' data, and nobody hacked it > Source: > Published: 2026-10-27 06:23:36+00:00 OpenAI, March 2023 # ChatGPT leaked users' data, and nobody hacked it - When - Monday 20 March 2023. OpenAI says a change to its server at 1 a.m. Pacific time caused a spike in Redis request cancellations; the payment exposure fell in a nine-hour window, 1 a.m. to 10 a.m. Pacific. - What was exposed - Some users could see titles from another active user's chat history, and possibly the first message of a new conversation. For 1.2% of ChatGPT Plus subscribers active in the window, name, email address, payment address, card type, the last four digits of the card and its expiry date may have been visible to another user. Full card numbers were not exposed. - Cause - A bug in redis-py, the open-source Python client for Redis, in its asyncio client for Redis Cluster as OpenAI ran it. A request cancelled after it was sent but before its response was read left that response in the pooled connection, and the next request could receive it. - Not an attack - OpenAI describes a bug in an open-source library and a change it inadvertently introduced. The CVE records for the library bug list no exploitation. - Afterwards - OpenAI added redundant checks that the data returned by its Redis cache matches the requesting user. Italy's data protection authority restricted ChatGPT on 30 March 2023; its December 2024 fine included not notifying it of the March 2023 breach, and a court in Rome upheld the challenge to that decision in March 2026. - Primary sources - OpenAI, "March 20 ChatGPT outage: Here's what happened", 24 March 2023; redis-py issues #2624 and #2665 and pull requests #2641, #2666 and #2695; CVE-2023-28858 and CVE-2023-28859; the Garante's order of 30 March 2023 and releases of 31 March 2023, 28 April 2023 and 20 December 2024. On Monday 20 March 2023, some people using ChatGPT started seeing titles from other people’s chat histories in their own. For a smaller group the exposure was worse: OpenAI says the payment-related information of 1.2% of ChatGPT Plus subscribers active during a nine-hour window may have been visible to another user. Nobody attacked it. OpenAI’s post-mortem, published four days later, traces it to a change on its own server, a cancelled request, a pooled connection, and a bug in an open-source library. It is a clean example of a cache being trusted to know whose data it held. ## What was serving the pages OpenAI used Redis to cache user information “so we don’t need to check our database for every request,” spread across “multiple Redis instances” as a Redis Cluster. Its Python server talked to Redis through redis-py, the open-source client library, and ran on asyncio. The library kept “a shared pool of connections between the server and the cluster,” and recycled a connection for another request once done. None of that is unusual. The trouble is in what happens to a borrowed connection when its request is cancelled halfway. ## Two queues and a cancelled request With asyncio, OpenAI explains, requests and responses on a connection “behave as two queues: the caller pushes a request onto the incoming queue, and will pop a response from the outgoing queue, and then return the connection to the pool.” Cancel a request in between and “the connection thus becomes corrupted and the next response that’s dequeued for an unrelated request can receive data left behind in the connection.” Most of the time that broke loudly: “In most cases, this results in an unrecoverable server error, and the user will have to try their request again.” The dangerous case was quiet: “in some cases the corrupted data happens to match the data type the requester was expecting, and so what gets returned from the cache appears valid, even if it belongs to another user.” ## Monday, 20 March “At 1 a.m. Pacific time on Monday, March 20, we inadvertently introduced a change to our server that caused a spike in Redis request cancellations. This created a small probability for each connection to return bad data.” OpenAI does not say what the change was. Some users saw other users’ chat titles, and possibly the first message of a newly created conversation. For ChatGPT Plus subscribers there were two routes to someone else’s details, both between 1 a.m. and 10 a.m. Pacific time that Monday: a subscription confirmation email, some of which “were sent to the wrong users,” or the “Manage my subscription” page. What may have been visible was “first and last name, email address, payment address, credit card type and the last four digits (only) of a credit card number, and credit card expiration date.” “Full credit card numbers were not exposed at any time,” and OpenAI believes “the number of users whose data was actually revealed to someone else is extremely low.” OpenAI took ChatGPT offline and brought it back once the bug was patched, restoring chat history later “with the exception of a few hours of history.” ## The library The same kind of failure had already been reported in public. On 17 March 2023, three days earlier, a developer opened issue [#2624](https://github.com/redis/redis-py/issues/2624) on redis-py: “Canceling async Redis command leaves connection open, in unsafe state for future commands.” Nothing on the record says anyone at OpenAI saw it. The maintainers merged a fix, [#2641](https://github.com/redis/redis-py/pull/2641), on 22 March, released as 4.5.3. The same day the reporter replied: “I think this only fixed the pipeline, while the race condition still exists in the `Redis` class… I can still reproduce #2624 using the latest redis-py `4.5.3`.” OpenAI’s post-mortem followed on 24 March. On 25 March the reporter opened [#2665](https://github.com/redis/redis-py/issues/2665), calling it “the same issue that recently got a lot of attention due to ChatGPT outage.” A wider fix, [#2666](https://github.com/redis/redis-py/pull/2666), wrapped commands “with a shield” and shipped in 4.5.4 on 29 March. It did not last. On 20 April a contributor wrote on it, “I believe this PR was a mistake,” pointing to [#2695](https://github.com/redis/redis-py/pull/2695), which undid the change and was released in 4.5.5 on 8 May 2023. Two CVE records cover the library bug. The first, CVE-2023-28858, notes it “was initially created in response to reports about ChatGPT”; CVE-2023-28859 covers “data leakage across AsyncIO connections in general.” ## What OpenAI changed OpenAI listed six actions: testing the fix, redundant checks on the cache, examining its logs “to make sure that all messages are only available to the correct user,” correlating data sources to identify and notify affected users, better logging, and a more robust Redis cluster. The one that matters most is the second: “Added redundant checks to ensure the data returned by our Redis cache matches the requesting user.” On 20 March, whatever the server checked did not catch a valid-looking answer that belonged to someone else. The check does not assume the library is fixed or the cache is never wrong. It assumes it might be. ## Afterwards, in Italy On 30 March 2023 Italy’s data protection authority, the Garante, ordered a temporary limitation on processing Italian users’ data. Its announcement the next day mentioned the breach of 20 March; the order itself rested on other grounds: the information given to users, the legal basis for training data, accuracy, and age checks. On 28 April the Garante reported that OpenAI had made ChatGPT accessible to Italian users again. In December 2024 the Garante announced a fine of 15 million euros, noting among other things that OpenAI had not notified it of the breach suffered in March 2023. The Garante’s own page now records that a Rome court upheld the challenge to that decision, in a judgment published on 18 March 2026. ## Four lessons for infrastructure teams **Cancelling is a change of state.** If code can be interrupted halfway through talking to something, decide what the half-finished conversation leaves behind, and clean it up or throw the connection away. **Check ownership at the boundary.** A cache, a queue or a shared pool does not know who is asking. If the answer is about a person, compare it with the person who asked before handing it over. **The quiet failure is the dangerous one.** Most of these leftovers caused errors that users retried. The harm was in the rare case that looked like success. **A dependency’s bug tracker is part of your system.** Here a report of the same kind of failure was public three days before, the first fix was partial, and the second was later replaced. Read the fix, not just the version number. ## Sources - OpenAI, [March 20 ChatGPT outage: Here’s what happened](https://openai.com/index/march-20-chatgpt-outage/) , 24 March 2023. The company’s own account, and the source for every claim about the incident, its mechanism and its fixes. - redis-py: issue [#2624](https://github.com/redis/redis-py/issues/2624) (17 March 2023), pull request[#2641](https://github.com/redis/redis-py/pull/2641) and its comments (22 March), issue[#2665](https://github.com/redis/redis-py/issues/2665) (25 March), pull request[#2666](https://github.com/redis/redis-py/pull/2666) and the comment of 20 April, pull request[#2695](https://github.com/redis/redis-py/pull/2695) (8 May). - [CVE-2023-28858](https://www.cve.org/CVERecord?id=CVE-2023-28858) and[CVE-2023-28859](https://www.cve.org/CVERecord?id=CVE-2023-28859) . - Garante per la protezione dei dati personali: [order of 30 March 2023](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9870832) ,[release of 31 March 2023](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9870847) ,[release of 28 April 2023](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9881490) ,[release of 20 December 2024](https://www.garanteprivacy.it/home/docweb/-/docweb-display/print/10085432) , with its note on the Rome court’s judgment. Corrections are welcome, and any made are listed, dated, at the end of this article. ## Questions this answers ## What happened in the ChatGPT data leak of March 2023? On 20 March 2023 some ChatGPT users could see titles from other users' chat histories, and for 1.2% of ChatGPT Plus subscribers active during a nine-hour window, payment details including the last four digits of a card may have been visible to another user. OpenAI took ChatGPT offline and published a post-mortem on 24 March. ## Was the ChatGPT March 2023 incident a hack? No. OpenAI attributes it to a bug in the open-source redis-py library, triggered by a change OpenAI inadvertently introduced to its own server that caused a spike in cancelled Redis requests. Nobody attacked the service. ## Was the bug in Redis? No. In OpenAI's words, "The bug was discovered in the Redis client open-source library, redis-py." Redis itself worked as designed; the client library left a cancelled request's response in a shared connection. ## Were full credit card numbers exposed by ChatGPT? No. OpenAI says "Full credit card numbers were not exposed at any time." What may have been visible was name, email address, payment address, card type, the last four digits and the expiry date. ## What did OpenAI change after the March 2023 incident? It listed six actions, including extensive testing of the fix, redundant checks to ensure the data returned by its Redis cache matches the requesting user, examining its logs, identifying affected users to notify them, better logging, and a more robust Redis cluster.