True, but we don't know if oai emailed their customers to tell them as soon as mixpannel told them. The regulation says they only have to notify affected parties.

I wonder whether OpenAI could be okay if they themselves weren't notified within 72hrs.