Pornhub Admits Analytics Leak as Hackers Claim 200M Records of Viewing Data

Pornhub says a cybersecurity incident tied to Mixpanel, a third-party analytics provider, has exposed sensitive activity data for some Premium users, raising fears of targeted blackmail and sextortion scams if the information is released or sold.

Data breaches like this aren't unusual. In fact, data shows that last year there were over 3,100 reported data compromises in the US alone. Cybersecurity experts say there have been more than 75,000 since 2005.

The Pornhub data breach is only the latest in a long line of security nightmares that users have to worry about.

In a notice dated Dec. 12 and updated Dec. 16, Pornhub told Premium users that an “unauthorized party gained unauthorized access to analytics data stored with Mixpanel,” and extracted a “limited set of analytics events” tied to certain accounts. The company emphasized that “this was not a breach of Pornhub Premium’s systems,” and said passwords, payment details, and financial information were not exposed.

For users, the nature of the data matters far more than whether credit cards were touched.

Security researchers and journalists who reviewed samples of the allegedly stolen dataset say the material includes deeply personal behavioral logs, including registered email addresses, location signals, video titles, video URLs, and timestamps showing what a Premium user watched, viewed, or downloaded.

Reports also say the dataset contains search history. Pornhub acknowledged only that “analytics events” were accessed, while saying its investigation is ongoing.

The extortion threat has been linked in public reporting to ShinyHunters, a hacking and extortion group that claims it obtained 94GB of Pornhub-related data containing more than 200 million records. The group has a history of using stolen databases to pressure companies into paying ransoms and to fuel secondary scams.

Mixpanel, which disclosed a breach discovered on Nov. 8, has publicly pushed back on the claim that Pornhub’s data came from its incident. The company said it found no indication that the Pornhub dataset was taken during the November breach and argued that the data was last accessed via a legitimate employee account connected to Pornhub’s parent company in 2023.

That dispute leaves a key question unresolved: whether the dataset originated in Mixpanel’s systems, a separate compromise involving Pornhub or its parent company, or a different leak pathway entirely. For affected users, the technical origin may be beside the point. The anxiety comes from what the records reveal.

Porn-related breaches are routinely considered among the most personally damaging because the data can be weaponized even without passwords or payment information. A credible-looking message that references specific videos, searches, dates, or locations can be enough to pressure targets into paying money, even if the attacker never truly had access to a device or account.

Sextortion scams have long relied on bluff and generic language. A dataset that includes real viewing and search history would allow criminals to write threats that feel specific and convincing.

Pornhub said it “immediately launched a comprehensive internal investigation” with cybersecurity experts and has engaged relevant authorities. The company told users to remain vigilant and to monitor for suspicious emails or unusual activity. It also said the affected account has been secured and that the unauthorized access has been stopped.

The company has not said how many users were affected, which regions were impacted, or how far back the analytics events go. Mixpanel has said it has roughly 8,000 customers, meaning any breach involving customer analytics could span millions of end users, depending on how those customers configured event logging.

For now, Pornhub’s message is that its core Premium systems were not breached. The allegation driving the story is that the analytics exhaust surrounding Premium usage was enough to expose people anyway.