Forget the breach, what are they doing allowing a third party like Mixpanel access to such sensitive data in the first place?

I always teach companies to treat user information as somewhat toxic (i.e. a liability). Search and view history... it doesn't get much more personal than this.