Perceptive Security
SOC/SIEM Consultancy
PornHub extorted after hackers steal Premium member activity data
Published:
15 December 2025 at 21:27:07
Alert date:
15 December 2025 at 22:01:46
Source:
bleepingcomputer.com
Data Breach & Exfiltration, Supply Chain & Dependencies
PornHub is being extorted by the ShinyHunters cybercriminal gang after hackers allegedly stole Premium member activity data including search and watch history. The breach reportedly occurred through a Mixpanel data breach incident. The extortion involves sensitive user data from the adult video platform's premium subscribers. This represents a significant privacy breach affecting PornHub's paying customers. The incident involves the established ShinyHunters group known for previous high-profile data breaches and extortion campaigns.
Technical details
ShinyHunters compromised Mixpanel through an SMS phishing (smishing) attack on November 8th, 2025. The breach exposed 94GB of data containing over 201 million records of historical analytics data from PornHub Premium members dating from 2021 or earlier. The stolen data includes email addresses, activity types (watched/downloaded videos, viewed channels, search histories), location data, video URLs, video names, keywords associated with videos, and timestamps of events. The breach affected multiple Mixpanel customers including OpenAI, CoinTracker, and PornHub.
Mitigation steps:
Organizations using Mixpanel should review their data exposure from the November 8th, 2025 breach. Companies should verify what analytics data was being sent to third-party services and assess potential privacy impacts. Affected users should be notified of data exposure. Organizations should implement stronger vendor risk management and review third-party data sharing practices.
Affected products:
Mixpanel analytics platform
PornHub Premium
OpenAI API
CoinTracker
Oracle E-Business Suite
Salesforce
Related links:
https://www.bleepingcomputer.com/news/security/openai-discloses-api-customer-data-breach-via-mixpanel-vendor-hack/
https://help.pornhub.com/hc/en-us/articles/47334442459283-Important-Message-From-Pornhub
https://mixpanel.com/blog/sms-security-incident/
https://www.bleepingcomputer.com/news/security/oracle-silently-fixes-zero-day-exploit-leaked-by-shinyhunters/
https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/
https://www.bleepingcomputer.com/news/security/shinyhunters-starts-leaking-data-stolen-in-salesforce-attacks/
https://www.bleepingcomputer.com/news/security/meet-shinysp1d3r-new-ransomware-as-a-service-created-by-shinyhunters/
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.