A serious privateness breach has surfaced involving the non-public viewing histories of tens of millions of people that as soon as held Pornhub Premium accounts. The cybercriminal gang ShinyHunters claims to have stolen a 94GB database containing over 200 million information (201,211,943 to be exact) of person searches, downloads, and video exercise. They’ve already launched an extortion marketing campaign, reportedly demanding ransom in Bitcoin.
Based on researchers at digital dangers and vulnerabilities administration agency Rescana, the difficulty started with a safety lapse at Mixpanel, a third-party firm that tracks web site analytics. This is similar firm whose breach impacted OpenAI and uncovered its API person information final month.
As per Rescana’s weblog submit and Mixpanel’s official safety discover, the breach started on November 8, 2025, when hackers used a smishing assault (sending misleading textual content messages to staff to steal their login particulars) to achieve unauthorised entry to Mixpanel’s methods.
Delicate Knowledge and Extortion
The stolen information include deeply non-public information. Based on BleepingComputer, which reviewed samples of the information, the information embrace:
- E-mail addresses and approximate places (metropolis and nation).
- Exercise particulars like video names, URLs, and search key phrases.
- Timestamps displaying when every video was watched or downloaded.
The hackers are already sending extortion emails to affected corporations, threatening to leak all the pieces until they’re paid. It’s value noting, although, that Pornhub’s personal inner methods weren’t instantly hacked. The platform has confirmed that delicate stuff like passwords and bank card particulars are nonetheless safe.
Verifying the Stolen Knowledge
To show the information is actual, ShinyHunters shared information from 14 customers of Pornhub’s Premium tier. Reuters confirmed the information was genuine after matching particulars for six of these folks towards earlier leaks held by the agency District 4 Labs. Three of these people confirmed they had been, in actual fact, former subscribers. Whereas the hackers gained’t say precisely how they received the information, these findings show actual person data is on the market.
Conflicting Studies on Knowledge Entry
It’s value noting that, in keeping with Pornhub’s assertion, it formally stopped utilizing Mixpanel in 2021, so these information are at the very least 4 years previous. However right here’s the place the story will get messy: the 2 corporations now disagree on what truly occurred.
Whereas Pornhub initially blamed the Mixpanel breach, as of December 16, 2025, it has eliminated these mentions from its official advisory. On that very same day, Mixpanel claimed the information was truly final accessed in 2023 by a “reliable worker account” belonging to Pornhub’s mother or father firm, Aylo. This means a separate account compromise reasonably than a direct hit on the analytics supplier’s servers.
