Loading story…
ShinyHunters, a well-known hacking group, claimed responsibility for a breach at analytics provider Mixpanel, resulting in the exposure of historical analytics data related to Pornhub Premium users. The compromised data reportedly includes search, watch, and download activity, but does not contain passwords, payment information, or government IDs. Pornhub clarified that its own systems were not breached and that the affected data was legacy information from when the company used Mixpanel prior to 2021. The breach has raised concerns about the security of third-party vendors and the risks of retaining historical user data.
Following the breach, ShinyHunters began extorting Mixpanel customers, including Pornhub, threatening to publish the stolen data unless a ransom was paid. The group claims to possess over 200 million records tied to Pornhub Premium users. While Pornhub and Mixpanel have both launched investigations, Mixpanel disputes that the data originated from its recent November 2025 incident, suggesting the data may have been accessed through other means. Users are advised to remain vigilant for phishing attempts and to enable multi-factor authentication as a precaution.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
Mixpanel publicly denied that the Pornhub data was stolen from its systems during the November 2025 smishing incident, arguing the data may instead have been accessed earlier through a legitimate Aylo employee account in 2023. The company said the affected account had since been secured.
Security researchers and outside verification efforts, including reports citing BreachForums posts and independent analysis, confirmed that at least some of the exposed Pornhub-related data appeared authentic.
Pornhub stated that the incident involved a third-party analytics provider rather than Pornhub's own infrastructure. It said no passwords, payment information, or government IDs were exposed and launched an internal investigation with outside experts and authorities.
ShinyHunters started threatening to publish the stolen analytics data unless ransoms were paid, targeting Pornhub and other Mixpanel customers. The campaign turned the data theft into an active extortion incident.
Following the Mixpanel incident, ShinyHunters claimed it had obtained 94GB of Pornhub Premium user analytics data, including more than 200 million records of search, watch-history, location, and timestamp information.
On November 8, 2025, Mixpanel was reportedly compromised through an SMS phishing or smishing attack. The intrusion allegedly exposed customer analytics data later tied to Pornhub Premium user activity.
Mixpanel said the affected Pornhub-related data was last legitimately accessed in 2023 by an employee account belonging to Pornhub's parent company, Aylo. This later became central to Mixpanel's dispute over how the data was obtained.
Pornhub said it stopped using Mixpanel in 2021, indicating the exposed analytics data was legacy information from that period or earlier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcego.theregister.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers have stolen a massive trove of user data from PornHub, one of the world's largest adult websites, exposing millions of users to potential extortion and privacy risks. The breach, attributed to the ShinyHunters group, reportedly involved the theft of over 200 million records, including email addresses, usernames, and encrypted passwords. The attackers are believed to be leveraging this sensitive information for extortion purposes, targeting users with threats of exposure unless a ransom is paid. The incident has reignited concerns about the security of high-traffic adult platforms and the adequacy of their encryption and third-party risk management practices. Security experts warn that the breach could lead to widespread credential stuffing and phishing campaigns, given the scale and sensitivity of the data involved. Investigations are ongoing, and affected users are advised to change their passwords and remain vigilant for suspicious communications. The breach underscores the persistent threat posed by organized cybercriminal groups and highlights the need for robust security measures and rapid incident response in the face of large-scale data compromises.
Jun 29, 2026
SoundCloud, Pornhub, and 700Credit have each confirmed significant data breaches impacting millions of users. SoundCloud reported unauthorized access to an ancillary service dashboard, affecting approximately 20% of its 140 million users—about 28 million people. The exposed data included email addresses and information already visible on public profiles, with no passwords or financial details compromised. The incident also caused temporary connectivity issues for some users, particularly those using VPNs, due to configuration changes made during the response. Pornhub notified select Premium subscribers that some user data was exposed following a breach at Mixpanel, a third-party analytics provider, but emphasized that sensitive information such as passwords, payment details, and government IDs were not affected. Pornhub had ceased using Mixpanel in 2021 and was informed of the breach by the vendor. 700Credit, a US-based provider of credit and identity verification services, suffered a third-party supply-chain attack that compromised the personal information of approximately 5.6 million individuals. The breach, which occurred between May and October 2025, involved unauthorized access to names, addresses, dates of birth, and Social Security numbers through a compromised API used by one of 700Credit's integration partners. 700Credit has since shut down the affected API, notified federal authorities, and is offering credit monitoring to victims. These incidents highlight the ongoing risks posed by third-party service providers and the importance of timely breach notification and response.
Jun 29, 2026
ShinyHunters claimed responsibility for a major breach affecting Carnival Corporation, with data tied to Holland America Line’s **Mariner Society** loyalty program appearing online after an alleged extortion attempt failed. According to Have I Been Pwned, the leaked dataset contained **8.7 million records** and **7.5 million unique email addresses**, including names, dates of birth, genders, and loyalty program status details. Carnival acknowledged a security incident and said it had identified a phishing attack involving a single user account, while continuing to assess the scope of unauthorized access; the gang separately alleged it also stole terabytes of internal corporate data, a claim that had not been independently verified. The same group also posted a **"Pay or Leak"** notice claiming it had compromised Udemy and stolen more than **1.4 million user records** along with internal corporate data, giving the company a deadline before any public release. Udemy had not confirmed the incident at the time of reporting, leaving the claim unverified, but the allegation fits a broader ShinyHunters campaign targeting SaaS and education organizations through social engineering, credential theft, MFA bypass, and abuse of third-party access. The incidents underscore the group’s continued use of extortion-backed data theft to pressure victims and expose customer information.
Jun 29, 2026