Analytics service Mixpanel was accidentally collecting passwords in some clients' apps from March 2017 to January 2018, was slow to notify clients and public
Josh Constine / TechCrunch : Tweets: @joshconstine and @joshconstine Tweets: Josh Constine / @joshconstine : Startups: Don't be like Mixpanel. If you have a security breach, be public about as soon as it's safe to. http://tcrn.ch/2Enzay7 Josh Constine / @joshconstine : Mixpanel hadn't made a public announcement about this privacy fail until TechCrunch's inquiry http://tcrn.ch/2Enzay7
Context & Ripple Effects
Mixpanel's disclosure problem is the story here as much as the bug itself: passwords were flowing into its analytics pipeline from client apps for roughly ten months, and the company only spoke publicly after Josh Constine's TechCrunch inquiry forced the issue. Weeks later, [[a:927093|Princeton researchers found some analytics firms were still accidentally collecting user passwords]], with Mixpanel issuing fixes after those earlier findings — evidence the class of bug outlived this single incident.
The long tail matters too: seven years on, OpenAI terminated its Mixpanel use after a November security incident exposed API account names, showing how a vendor's security record follows it into the AI era's biggest accounts. This sits alongside sibling analytics leaks like Facebook's misrouted weekly reports and Twitter's cached developer keys — all cases where instrumentation tooling quietly handled credentials it was never meant to see.
First-order effects
- Clients whose apps embedded Mixpanel's SDK during the March 2017–January 2018 window must assume password capture occurred and audit whether users need to reset credentials — an operational burden Mixpanel's slow notification extended.
- Mixpanel's sales pitch to privacy-sensitive customers takes a direct hit, since the company had to be prompted by press rather than volunteering the disclosure.
Second-order effects
- Rival analytics vendors gain a differentiation angle — marketing SDKs that never ingest credential fields — while app developers add data-handling audits to vendor selection criteria.
- The episode pushes the broader analytics industry toward defensive engineering, because Princeton's follow-up showed the same accidental-collection bug recurring across firms even after public exposure.
Third-order effects
- If the pattern holds, third-party SDKs get treated as a standing supply-chain risk surface, with buyers demanding contractual disclosure timelines rather than relying on vendors' judgment about when 'it's safe' to go public.
- Regulators and platform owners have a documented case for tightening rules on what telemetry SDKs may collect, shifting enforcement from voluntary vendor norms toward mandated boundaries.
The trend: Third-party analytics SDKs are becoming a recurring privacy-liability layer in the app ecosystem, where a vendor's disclosure speed increasingly determines whether it keeps major customers.