ShinyHunters Hackers Target Pornhub Premium Users in Major Data Breach, Demand Bitcoin Ransom

ShinyHunters has declined to provide specific details about the breach methodology.

Washington:

On Tuesday, the notorious hacking collective "ShinyHunters" announced they had obtained data belonging to premium subscribers of Pornhub, the popular adult content platform, and threatened to release this information publicly unless their demands were met.

While Reuters could not immediately verify the complete extent or specifics of the breach, the hackers provided data samples that Reuters was able to partially authenticate through independent verification.

Three former Pornhub premium customers – two Canadian men and one American – confirmed to Reuters that their personal information included in the samples was genuine, though dating back several years. These individuals spoke under condition of anonymity given the sensitive nature of the breach.

"We're demanding a ransom payment in Bitcoin to prevent the publication of [Pornhub] data and delete the data," ShinyHunters communicated to Reuters during an online conversation.

When contacted, neither Pornhub nor its parent company Ethical Capital Partners, headquartered in Ottawa, Canada, responded to requests for comment. The cybersecurity news outlet Bleeping Computer first broke the story about this data breach.

Pornhub ranks among the internet's most visited adult content websites, reportedly attracting over 100 million daily visits and 36 billion annual visits, primarily offering video content with a significant portion available free of charge.

ShinyHunters shared information allegedly from 14 users subscribed to Pornhub Premium, a service that provides enhanced features including high-definition video quality, ad-free viewing experience, and virtual reality content.

Reuters managed to match details of six individuals from ShinyHunters' sample to information previously exposed in other data breaches and preserved by Dark Web intelligence firm District 4 Labs. Three affected individuals confirmed to Reuters they had previously subscribed to Pornhub's premium service.

The exact method by which ShinyHunters acquired this data remains unclear. The hacking group declined to elaborate on their breach methodology.

In a December 12 statement, Pornhub disclosed a recent cybersecurity incident involving third-party analytics provider Mixpanel that affected an undisclosed number of Pornhub Premium subscribers. The statement indicated the incident occurred within Mixpanel's environment and involved a "limited set of analytics events for some users."

Mixpanel, which provides clients with detailed user activity analytics, had previously announced a cybersecurity incident on November 27.

In a Tuesday statement to Reuters, Mixpanel acknowledged awareness of Pornhub's statement but maintained they "can find no indication that this data was stolen from our November 2025 security incident or otherwise."

According to Mixpanel, Pornhub's data on their platform was last accessed by "a legitimate employee account at Pornhub's parent company in 2023." The statement continued: "If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel."

ShinyHunters claimed to Reuters that the data was connected to the recent Mixpanel security incident. However, Mixpanel firmly denied this assertion, stating they had conducted a thorough investigation of the November incident with external cybersecurity experts and had notified all affected clients.

"We are confident Pornhub was not among those clients and that this data is unrelated to the November incident," a company spokesperson stated via email.

ShinyHunters has established itself as a prominent hacking group, linked to numerous high-profile data breaches and extortion attempts in recent months, including attacks targeting Salesforce customers and luxury retailers in the United Kingdom.