ShinyHunters Claims Pornhub Premium Data Breach, Demands Bitcoin Ransom

On Tuesday, a hacking group calling itself ShinyHunters announced it had stolen account information from Pornhub Premium subscribers and was demanding Bitcoin to keep the data from being released publicly. The group provided a sample of what it claimed to have taken—records from fourteen premium users—and Reuters was able to verify that at least some of it was genuine. Three people whose data appeared in the sample, two from Canada and one from the United States, confirmed to Reuters that the information matched their accounts, though the records were several years old.

The scope of the breach remains unclear. Reuters could not immediately determine how many users were actually affected or precisely how ShinyHunters obtained the data. When asked for details about their methods, the group declined to elaborate. What is certain is that Pornhub Premium—the paid tier offering high-definition video, ad-free viewing, and virtual reality content—was the target, and the hackers were explicit about their intent: release the data unless they received a ransom payment in Bitcoin.

Pornhub and its parent company, Ethical Capital Partners, based in Ottawa, did not respond to requests for comment. However, on December 12, Pornhub issued a statement acknowledging a cybersecurity incident involving Mixpanel, a third-party analytics platform the company uses to track user behavior and engagement. According to Pornhub, the incident affected some Premium users and involved what the company described as a "limited set of analytics events." Mixpanel had disclosed its own security breach on November 27, which prompted Pornhub's disclosure.

But here the story fractures. Mixpanel, in a statement to Reuters, flatly rejected the suggestion that ShinyHunters obtained Pornhub data through its November incident. The company said it had conducted a thorough investigation with external cybersecurity experts and found no evidence that Pornhub was among the affected clients. Mixpanel added that Pornhub's data in its system had last been accessed by a legitimate employee account at Pornhub's parent company in 2023. If the data is now in unauthorized hands, Mixpanel argued, it did not come from their November breach.

ShinyHunters, for its part, told Reuters the data was connected to the recent Mixpanel incident—a claim Mixpanel's spokesperson dismissed as unfounded. The disagreement leaves the actual source of the breach unresolved. Pornhub blames Mixpanel; Mixpanel says the data predates its incident and was last touched by Pornhub itself years ago; and ShinyHunters is offering no clarity on how it obtained anything.

This is not ShinyHunters' first extortion campaign. The group has claimed responsibility for high-profile breaches in recent months, including attacks on Salesforce and luxury retailers in the United Kingdom. The pattern suggests a deliberate strategy: steal data, prove authenticity with samples, demand payment, and threaten public release. For Pornhub Premium users, the breach represents not just a privacy violation but potential exposure of viewing history and personal details tied to their accounts—information many would prefer to keep confidential. The question of whether the data actually came from Mixpanel or from Pornhub's own systems may matter for liability and remediation, but for the affected users, the distinction offers little comfort.