Hackers stole premium user data from Pornhub: what is known about the leak.

According to ТСН: A hacking group called ShinyHunters announced the breach of the premium users' database of the porn site Pornhub and is demanding a ransom in cryptocurrency to avoid disclosing the stolen information. Journalists have confirmed the authenticity of some of the stolen data from users in the USA and Canada.

On December 16, ShinyHunters claimed to have stolen personal data of Pornhub's premium users and threatened public disclosure of this information.

Currently, Reuters has not been able to determine the exact scale of the leak, but the attackers provided a sample of data that has been partially verified for authenticity. At least three former Pornhub users, including two Canadian citizens and one resident of the USA, confirmed that the information concerning them is indeed real, albeit dated several years back.

"We demand a ransom in bitcoins to prevent the publication of the [Pornhub] data and to delete them"

Pornhub itself and its owner, company Ethical Capital Partners, have yet to comment on the agency's inquiries.

The first reports of a possible information leak came from the cybersecurity platform Bleeping Computer.

Pornhub claims that its site receives over 100 million visitors daily, with an annual visit count reaching 36 billion. This is one of the most well-known platforms in the field of sexual content, where a significant portion of the offerings is free.

Data on premium users

ShinyHunters claim that the leak concerns 14 premium Pornhub users, who subscribe to a plan that grants access to high-quality videos, ad-free content, and virtual reality material.

Reuters managed to verify information about six individuals from the stolen data, which matched records from previous leaks logged by the darknet analysis firm District 4 Labs. Three of them confirmed that they had previously used Pornhub's premium service.

The origin of the stolen data remains unclear. Reuters was unable to find out how ShinyHunters accessed this information, and the attackers themselves did not provide details.

Cyber incident with Mixpanel

On December 12, Pornhub reported a cybersecurity incident involving the third-party analytics provider Mixpanel. According to the company, the incident affected an unspecified number of Pornhub Premium users and involved "a limited set of analytical events for some users".

Mixpanel, which provides client user behavior analytics, announced its cybersecurity incident on November 27.

In a comment to Reuters, the company stated that it is aware of Pornhub's statement but "has not found any indications that this data was stolen during our security incident in November 2025 or otherwise".

Mixpanel's official position is that the last access to Pornhub's data occurred through "the legitimate account of an employee of Pornhub's parent company in 2023".

"If this data ended up in unauthorized hands, we do not believe it was the result of a security incident at Mixpanel"

At the same time, ShinyHunters allege that the leak is indeed related to the recent incident at Mixpanel. The company denied this, emphasizing that the investigation was conducted in conjunction with independent cyber experts, and all affected clients were informed.

"We are confident that Pornhub was not among these clients and that this data is unrelated to the November incident"

Information about the hackers

ShinyHunters are known for numerous cyberattacks and extortion attempts, including those involving customer data from Salesforce and luxury retail chains in the UK.

Interestingly, four hackers were arrested in South Korea for breaching over 120,000 private and commercial IP cameras using weak passwords. The attackers were spying on people in apartments, gyms, and clinics, creating sexually exploitative content for sale on foreign websites.

This data leak situation underscores the growing risks associated with cybersecurity, especially in the context of serious threats to users' personal information. While Pornhub remains one of the most popular platforms in its segment, such incidents could significantly impact users' trust in the service.