According to a blog post by Group-IB on June 20, between June 2022 and May 2023, over 101,000 compromised logins for ChatGPT were exchanged on dark web marketplaces.
Dmitry Shestakov, the head of threat intelligence at Group-IB, stated that this number represents “the number of logs from stealer-infected devices that Group-IB analyzed,” with each log containing at least one combination of login credential and password for ChatGPT. The month of May experienced the highest peak, with nearly 27,000 ChatGPT-related credentials available on black markets.
The Asia-Pacific region had the highest number of compromised logins for sale, accounting for approximately 40% of the total figure. Indian-based credentials topped the list with over 12,500, while the United States ranked sixth with nearly 3,000 leaked logins. France secured the seventh position globally and took the lead in Europe. ChatGPT accounts can be created directly through OpenAI, and users also have the option to log in using their Google, Microsoft, or Apple accounts.
Although the research conducted by Group-IB did not analyze the sign-up methods, Shestakov suggested that accounts using a “direct authentication method” were likely the ones exploited. However, he emphasized that OpenAI should not be held responsible for the compromised logins, stating, “The identified logs containing saved ChatGPT credentials are not a result of any weaknesses in ChatGPT’s infrastructure.”
Group-IB’s blog post highlighted an increase in the number of employees using ChatGPT for work, raising concerns about the potential exposure of confidential company information to unauthorized users. Since user queries and chat history are stored by default, this information could be exploited by malicious actors to launch attacks against companies or individual employees. Shestakov revealed that “thousands of individual user devices all over the world” were infected by cybercriminals to steal this information. He emphasized the importance of regular software updates and the use of two-factor authentication to mitigate such risks.
Notably, Group-IB mentioned that the press release itself was written with the assistance of ChatGPT, showcasing the chatbot’s capabilities.
