(Credit: Nikos Pekiaridis/NurPhoto via Getty Images)
Pornhub is the latest company to confirm that its customers were involved in a Nov. 8 data breach through a third-party service, Mixpanel, which also affected companies like OpenAI.
The adult site confirmed on Dec. 12 that it had been impacted, although it hasn’t worked with Mixpanel since 2021. "The incident occurred within our analytics vendor Mixpanel’s environment and involved a limited set of analytics events for some users," it said.
Pornhub's notification says the situation "affects only select Premium users,” and "was not a breach of Pornhub Premium’s systems." Pornhub is currently conducting an internal investigation to help "determine the nature and scope of the reported incident."
According to Bleeping Computer, the hacking group ShinyHunters began extorting multiple Mixpanel customers last week, saying via email that it would publish stolen data unless a ransom was paid. ShinyHunters reportedly told Pornhub it has access to 94GB of data of its Premium users' viewing habits, including over 200 million records of personal information.
The hacker group shared a small amount of the data with Bleeping Computer, which confirmed it includes email addresses, locations, videos watched, and keywords associated with each video. It also showed when the video was watched and whether it was downloaded.
However, Mixpanel denies that this information comes from the November data breach. "The data was last accessed by a legitimate employee account at Pornhub’s parent company in 2023," Mixpanel says. "If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel."
Pornhub and its parent company Aylo have yet to comment on the reports of extortion. Aylo told its customers to "remain vigilant by monitoring their accounts for any suspicious emails or unusual activity." Be cautious when interacting with emails by verifying their origin and ensuring they're not phishing attempts. You should also read PCMag's guide on what to do if your information is stolen.
Pornhub is currently blocked in 23 US states over age-verification bills. The company is concerned, in part, that requiring people to verify their ages by providing personal information, such as copies of IDs or selfies, puts those individuals at risk in the event of a breach. Web users can get around the blockade by using a VPN, however.