Pornhub Breach Exposes 200 Million Users’ Every Search And Video—94GB Of Viewing History Dumped Online

Pornhub, one of the world’s largest adult entertainment websites, has confirmed a significant data breach affecting over 200 million Premium subscriber records. The incident, disclosed in mid-December 2025, originated from a cyberattack on third-party analytics provider Mixpanel.

Notorious hacking group ShinyHunters has claimed responsibility and is threatening direct extortion of affected users, raising serious privacy and sextortion concerns.​

What Data Was Compromised

The breach exposed approximately 94GB of sensitive user information including email addresses, viewing histories, search queries, video URLs, timestamps, location data, and activity types such as watched or downloaded content.

Reuters independently verified the authenticity of the leaked data by confirming details with three former Premium subscribers. Critically, Pornhub emphasizes that passwords, payment information, financial details, and government identification documents were not compromised in the incident.​

Timeline of the Attack

The breach began on November 8, 2025, when Mixpanel employees fell victim to a sophisticated SMS phishing (smishing) attack that granted hackers access to internal systems. Mixpanel discovered the unauthorized access the following day and began notifying affected partners.

The analytics company issued a public disclosure on November 27, while Pornhub published its security notice on December 12. Media outlets reported ShinyHunters’ extortion demands by December 15-16, 2025.​

The Mixpanel Connection

Pornhub stopped using Mixpanel’s analytics services in 2021, yet the vendor retained user data for at least four years after the business relationship ended. This revelation highlights a critical gap in third-party vendor management: legacy data retention by former service providers.

Mixpanel claims the exposed Pornhub data was last accessed by a legitimate employee at Pornhub’s parent company in 2023, suggesting the information remained on Mixpanel’s servers despite contract termination.​

Who Are ShinyHunters?

ShinyHunters is a notorious cybercriminal collective that emerged in 2020 and has since breached 91 major organizations worldwide.

Their high-profile victims include AT&T (73 million records), Microsoft (500GB source code), Ticketmaster (560 million records), and Tokopedia (91 million accounts). The group specializes in data theft, extortion, and increasingly uses AI-powered voice phishing, insider recruitment, and supply chain attacks to compromise targets.​

Extortion Threats Escalate

ShinyHunters has demanded a Bitcoin ransom from Pornhub and explicitly threatened to contact Premium users directly if payment is not received. This represents a dangerous escalation from organizational extortion to individual-level sextortion targeting.

Pornhub warned affected users they may receive emails claiming to possess personal information. The intimate nature of the exposed viewing histories creates asymmetric leverage for extortionists, who exploit embarrassment and social stigma.​

Sextortion Risks for Users

Cybersecurity experts warn that affected individuals may receive convincing extortion emails containing accurate details like email addresses or specific video titles from the leaked database.

Perpetrators typically threaten to expose viewing histories to employers, family members, or social contacts unless victims pay ransoms. Research indicates one in six mobile users faced sextortion attempts in 2024, and this breach provides criminals with verified data to enhance their targeting.​

Expert Advice: Never Pay Ransoms

Security professionals and law enforcement agencies unanimously advise breach victims never to pay extortion demands, as compliance rarely resolves the situation and often encourages continued harassment.

Individuals receiving threatening emails should not respond, block sender addresses while preserving communications as evidence, change account passwords immediately, enable multi-factor authentication, and report incidents to relevant platforms and authorities. Pornhub confirms it will never request passwords or payment information via email.​

Third-Party Vendor Vulnerabilities

The incident exemplifies cascading risks in modern supply chain security where analytics providers, cloud services, and other vendors maintain broad access to sensitive customer data across entire client portfolios.

When hackers compromised Mixpanel, they gained simultaneous access to information from multiple organizations including OpenAI, which also disclosed limited customer metadata exposure. Industry data shows supply chain breaches increased from 32% of incidents in 2024 to 44% in 2025.​

Regulatory Implications

The breach triggers notification requirements across multiple jurisdictions including the European Union’s GDPR, which mandates reporting within 72 hours of awareness.

Pornhub’s December 12 notification came 34 days after the November 8 breach, though the company may argue this timeline was necessary for forensic investigation of the vendor incident. GDPR violations can result in fines up to €20 million or 4% of global annual turnover.​

Why Adult Sites Are Targeted

Adult entertainment platforms face unique security challenges because they collect highly sensitive behavioral data while users maintain strong anonymity expectations. Research shows credential theft malware specifically targeting adult websites infected over 50,000 users with 300,000+ attack attempts during monitored periods.

Phishing attempts against Pornhub increased tenfold between 2017 and 2018. Underground markets offered more than 10,000 stolen adult website credential listings in 2018 alone.​

Historical Context: Ashley Madison

The 2015 Ashley Madison breach, which exposed 60GB of user data from the extramarital affair website including real names and addresses, demonstrated the devastating personal impact of adult platform compromises.

That incident led to public shaming, documented psychological harm, and reportedly contributed to suicide cases. The Pornhub breach, while not exposing payment details or real names directly, still reveals intimate viewing preferences that carry significant privacy and reputational risks.​

Data Retention Best Practices

Security experts emphasize that organizations must implement rigorous vendor offboarding protocols including verified data destruction certificates, credential revocation, integration disconnection, and technical audits confirming complete removal from vendor systems.

The four-year gap between Pornhub’s Mixpanel termination and this breach illustrates that legacy data presents enduring exposure. Contractual deletion requirements prove insufficient without technical verification of actual destruction.​

Social Engineering Attack Methods

The Mixpanel breach began with smishing—SMS-based phishing—which has become a preferred technique for sophisticated threat actors because text messages bypass email security controls and exploit implicit user trust. ShinyHunters increasingly employs AI-enabled voice phishing platforms to automate social engineering calls impersonating IT support or executives. The group also systematically recruits malicious insiders willing to provide network access for financial compensation.​

Broader Cybersecurity Trends

In 2025, 1,732 data breaches were publicly reported in the first half alone, representing a 5% increase over 2024. While total exposed records declined 88% due to fewer mega-breaches, such massive incidents now account for 30% of all breaches compared to 15% in 2024.

The global average breach cost was $4.44 million, with U.S. incidents averaging significantly higher at $10.22 million. Ransomware involvement surged to 44% of all breaches.​

Detection and Response Improvements

Organizations using advanced AI-driven security tools identified breaches in an average of 181 days in 2025, compared to 194 days in 2024—a 7% improvement in detection speed.

The median breach discovery time across all organizations was 51 days. However, supply chain incidents present unique response challenges because companies must coordinate with third parties and assess exposures across potentially extensive datasets with incomplete information.​

ShinyHunters’ Expanding Operations

Throughout 2025, ShinyHunters has systematically targeted data aggregators—platforms maintaining extensive consumer or enterprise information including analytics providers, cloud storage systems, and CRM platforms. This strategic approach enables simultaneous access to datasets spanning hundreds or thousands of underlying organizations.

The group’s demonstrated collaboration with other advanced threat collectives including Scattered Spider and Lapsus$ positions them among the most consequential cybercrime operations currently active.​

Pornhub’s Security Response

Following the breach disclosure, Pornhub has advised users to remain vigilant against potential phishing and sextortion attempts. The platform emphasized that its internal systems were not directly compromised and that financial information remains secure.

The company previously implemented significant security enhancements including content moderation improvements, verification requirements for uploads, and participation in anti-sextortion initiatives following regulatory investigations and advocacy pressure.​

Impact on Multiple Organizations

The Mixpanel breach affected numerous clients beyond Pornhub. OpenAI disclosed that limited API customer metadata including names, email addresses, approximate locations, and browser details were exposed, though API keys, passwords, and ChatGPT content remained secure.

OpenAI subsequently terminated its Mixpanel relationship and expanded security reviews across its vendor ecosystem. This cross-client impact demonstrates how single vendor compromises can cascade across diverse industries with varying regulatory requirements.​

Lessons for All Organizations

Security professionals emphasize that comprehensive protection requires extending visibility, controls, and accountability throughout complex vendor ecosystems.

Organizations should conduct thorough pre-engagement security assessments, continuously monitor vendor security posture, maintain precise data flow inventories, implement least-privilege access controls, and establish incident response protocols specifically for supply chain breaches. Employee security awareness training covering social engineering tactics remains critical, as human vulnerabilities often provide initial access for sophisticated attackers.​