- Pornhub says a Mixpanel compromise exposed some Premium‑user data, though not passwords or payment info
- Mixpanel disputes that its November breach leaked Pornhub data, while ShinyHunters claims responsibility
- Attackers allegedly hold 94GB of sensitive records, including emails, activity details, and viewing metadata
Adult website Pornhub has revealed some of its Premium members had their data compromised as part of a third-party supply chain attack.
In a data breach notification letter published on the company’s website dated December 12, Pornhub explained unnamed threat actors compromised Mixpanel, a third-party data analytics provider with which the company has not worked since 2021.
There, the hackers managed to obtain some sensitive data generated by the platform’s Premium users. Passwords, credentials, payment details, or government IDs were not taken, it stressed.
Hiding in plain sight
“Like Google, ChatGPT and others who were compromised as a part of the same attack, Mixpanel informed us of this breach,” it said. “Although we have not worked with Mixpanel since 2021, it is our responsibility to ensure we inform you of this event.”
Pornhub did not share any additional details, such as the number of the people affected by the breach, the nature of the information stolen, or the identity of the attackers.
The company said it launched a “comprehensive internal investigation”, engaged relevant authorities, as well as Mixpanel. It urged users to “remain vigilant” towards incoming email messages, especially those claiming to be coming from Pornhub.
The breach Pornhub refers to - which also affected Google and ChatGPT - was revealed in November 2025, with the Mixpanel breach attributed to ransomware actors ShinyHunters.
However, there are conflicting reports surrounding the attack, as Mixpanel, for example, told BleepingComputer it doesn’t believe Pornhub data was snatched during that particular incident.
"Mixpanel is aware of reports that Pornhub has been extorted with data that was allegedly stolen from us," Mixpanel told the publication. "We can find no indication that this data was stolen from Mixpanel during our November 2025 security Incident or otherwise."
"The data was last accessed by a legitimate employee account at Pornhub’s parent company in 2023. If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel."
The same publication also said that ShinyHunters confirmed being behind the breach. They claim to have stolen 94GB of data, holding more than 200 million records. They shared a sample apparently proving that the information they stole was highly sensitive, and includes email addresses, activity type, location, video URL, video names, keywords associated with videos, and the time the video was viewed.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
