"A security incident" is a nicer way of saying "security breach" once you run it through legal counsel.

The article you're reading states...

"We took comprehensive steps to _contain_ and eradicate unauthorized access"

That's a breach my friend.

That's a mixpanel breach if the unauthorised access was mixpanel staff accounts.

If someone phishes your gmail account, there is no gmail breach.

They also reset all passwords of all Mixpanel employees; that surely sounds like either Mixpanel staff accounts were compromised, or the breach was conducted via a staff account.

I really don't understand the point in downplaying this shitshow.