Adult content platform PornHub has confirmed it is being extorted by the ShinyHunters threat group after attackers claimed to possess historical analytics data tied to Premium user activity, including search, watch, and download histories.
The incident is connected to a recent breach at analytics provider Mixpanel, which was compromised on November 8, 2025, following an SMS phishing (smishing) attack. PornHub states it has not used Mixpanel since 2021, suggesting the exposed data is historical, not recent.
What data is allegedly exposed
According to ShinyHunters, the stolen dataset includes over 201 million records (94GB) containing:
- Email addresses
- Search and watch history
- Download activity
- Video URLs, names, and keywords
- Timestamps and location data
This type of data is considered extremely sensitive, even without passwords or payment information.
Conflicting statements
- PornHub: Confirms impact on select Premium users, but states no breach of its own systems
- Mixpanel: Says it found no evidence that the data came from its November breach and claims the data was last accessed by a legitimate PornHub parent-company account in 2023
- ShinyHunters: Confirms responsibility for the extortion emails and claims the data originated from Mixpanel-linked analytics
Threat actor background
ShinyHunters has been behind some of the largest breaches of 2025, including:
- Salesforce integration compromises
- Oracle E-Business Suite zero-day exploitation (CVE-2025-61884)
- GainSight breach affecting multiple organizations
- Ongoing Salesforce / Drift-related attacks
The group is also reportedly launching a ransomware-as-a-service (RaaS) platform called ShinySpid3r, linked to actors associated with Scattered Spider.
Why this matters
This case highlights the long-term risk of third-party analytics data, where historical records can still be leveraged years later for:
- Extortion
- Reputation damage
- Privacy violations
- High-impact psychological harm to victims
