Pornhub is investigating reports that hackers accessed the search and viewing habits of its premium users, with an extortion demand threatening to publish the data.
ShinyHunters, a group with a track record of breaches and ransom attempts, claims to hold more than 200 million records tied to premium accounts, including email addresses, search and viewing activity and location data, according to multiple reports.
In a statement on its website, Pornhub said the incident involved third‑party analytics provider Mixpanel and affected “a select number of users,” adding that “it is important to note this was not a breach of Pornhub Premium’s systems. Passwords, payment details and financial information remain secure and were not exposed.”
Pornhub added that “an unauthorized party” was able to extract “a limited set of analytics events for some users.” Other data taken could include “video URL, video name, keywords associated with the video, and the time the event occurred,” according to BleepingComputer.
ShinyHunters told Reuters: “We’re demanding a ransom payment in Bitcoin to prevent the publication of [Pornhub] data and delete the data.” Reuters said it was able to partially authenticate a sample of the information and that at least three former premium customers confirmed the data related to them, albeit several years old.
Mixpanel said it was “aware” of the alleged theft but found “no indication that this data was stolen from our November 2025 security incident or otherwise,” adding that Pornhub’s data with Mixpanel was last accessed by “a legitimate employee account at Pornhub’s parent company in 2023.” “If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel,” the company said.
Sophos told the Guardian it had seen no evidence of Pornhub data appearing on leak sites or in chat platforms linked to ShinyHunters, while describing the group as generally native English speakers in their late teens to early twenties and part of a broader cyber criminal community known as The Com.
Pornhub and its owner, Ethical Capital Partners, did not respond to Reuters’ requests for comment. ShinyHunters did not provide details on how the data was acquired. The scope and origin of the breach remain contested, with Pornhub pointing to historical analytics events and Mixpanel distancing the claims from its recent incident.
