Loading story…
Hackers have stolen a massive trove of user data from PornHub, one of the world's largest adult websites, exposing millions of users to potential extortion and privacy risks. The breach, attributed to the ShinyHunters group, reportedly involved the theft of over 200 million records, including email addresses, usernames, and encrypted passwords. The attackers are believed to be leveraging this sensitive information for extortion purposes, targeting users with threats of exposure unless a ransom is paid. The incident has reignited concerns about the security of high-traffic adult platforms and the adequacy of their encryption and third-party risk management practices.
Security experts warn that the breach could lead to widespread credential stuffing and phishing campaigns, given the scale and sensitivity of the data involved. Investigations are ongoing, and affected users are advised to change their passwords and remain vigilant for suspicious communications. The breach underscores the persistent threat posed by organized cybercriminal groups and highlights the need for robust security measures and rapid incident response in the face of large-scale data compromises.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
A cybersecurity weekly recap consolidated major incidents from the period, including the Pornhub breach, Cisco zero-days, ransomware developments, and multiple exploited vulnerabilities. This reference did not clearly introduce additional discrete dated events beyond those already separately described.
Reporting indicated that Chinese fraudsters were using AI-generated images to trick ecommerce platforms into issuing refunds. The tactic reflects growing criminal use of generative AI in online fraud operations.
The Haotian AI application was reported as being actively promoted to fraudsters in Southeast Asia. It enables realistic live-video face swaps that can be used to support scams and impersonation.
Two cybersecurity professionals from Sygnia Consulting and DigitalMint pleaded guilty to carrying out ransomware attacks. One of the attacks reportedly extracted $1 million from a Florida medical device company.
Venezuela's state oil company PDVSA suffered a cyberattack that disrupted operations. The company blamed the United States after a tanker seizure, though reporting suggested the impact may have been greater than publicly acknowledged.
The ShinyHunters group reportedly stole more than 200 million PornHub user records, likely via a third-party analytics provider, and began extorting the company. Separate reporting also described a large-scale credential theft affecting an adult platform and highlighted the Pornhub Premium breach as a major incident.
Cisco revealed an unpatched zero-day vulnerability affecting its Secure Email Gateway and Web Manager products. The company said the flaw had been exploited since November by a suspected Chinese state-sponsored group and provided mitigations while no patch was yet available.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters, a well-known hacking group, claimed responsibility for a breach at analytics provider Mixpanel, resulting in the exposure of historical analytics data related to Pornhub Premium users. The compromised data reportedly includes search, watch, and download activity, but does not contain passwords, payment information, or government IDs. Pornhub clarified that its own systems were not breached and that the affected data was legacy information from when the company used Mixpanel prior to 2021. The breach has raised concerns about the security of third-party vendors and the risks of retaining historical user data. Following the breach, ShinyHunters began extorting Mixpanel customers, including Pornhub, threatening to publish the stolen data unless a ransom was paid. The group claims to possess over 200 million records tied to Pornhub Premium users. While Pornhub and Mixpanel have both launched investigations, Mixpanel disputes that the data originated from its recent November 2025 incident, suggesting the data may have been accessed through other means. Users are advised to remain vigilant for phishing attempts and to enable multi-factor authentication as a precaution.
Jun 29, 2026
SoundCloud, Pornhub, and 700Credit have each confirmed significant data breaches impacting millions of users. SoundCloud reported unauthorized access to an ancillary service dashboard, affecting approximately 20% of its 140 million users—about 28 million people. The exposed data included email addresses and information already visible on public profiles, with no passwords or financial details compromised. The incident also caused temporary connectivity issues for some users, particularly those using VPNs, due to configuration changes made during the response. Pornhub notified select Premium subscribers that some user data was exposed following a breach at Mixpanel, a third-party analytics provider, but emphasized that sensitive information such as passwords, payment details, and government IDs were not affected. Pornhub had ceased using Mixpanel in 2021 and was informed of the breach by the vendor. 700Credit, a US-based provider of credit and identity verification services, suffered a third-party supply-chain attack that compromised the personal information of approximately 5.6 million individuals. The breach, which occurred between May and October 2025, involved unauthorized access to names, addresses, dates of birth, and Social Security numbers through a compromised API used by one of 700Credit's integration partners. 700Credit has since shut down the affected API, notified federal authorities, and is offering credit monitoring to victims. These incidents highlight the ongoing risks posed by third-party service providers and the importance of timely breach notification and response.
Jun 29, 2026
ShinyHunters claimed responsibility for a major breach affecting Carnival Corporation, with data tied to Holland America Line’s **Mariner Society** loyalty program appearing online after an alleged extortion attempt failed. According to Have I Been Pwned, the leaked dataset contained **8.7 million records** and **7.5 million unique email addresses**, including names, dates of birth, genders, and loyalty program status details. Carnival acknowledged a security incident and said it had identified a phishing attack involving a single user account, while continuing to assess the scope of unauthorized access; the gang separately alleged it also stole terabytes of internal corporate data, a claim that had not been independently verified. The same group also posted a **"Pay or Leak"** notice claiming it had compromised Udemy and stolen more than **1.4 million user records** along with internal corporate data, giving the company a deadline before any public release. Udemy had not confirmed the incident at the time of reporting, leaving the claim unverified, but the allegation fits a broader ShinyHunters campaign targeting SaaS and education organizations through social engineering, credential theft, MFA bypass, and abuse of third-party access. The incidents underscore the group’s continued use of extortion-backed data theft to pressure victims and expose customer information.
Jun 29, 2026