A data breach involving analytics company Mixpanel has left PornHub facing a serious privacy fallout.
The stolen data includes email addresses, approximate locations, search terms, and viewing histories linked to PornHub Premium users.
PornHub’s internal systems were not breached, but the event exposes a larger problem: once personal data is collected, it can live on indefinitely in third-party systems that may later be compromised.
PornHub confirmed that “a recent cybersecurity incident involving Mixpanel, a third-party data analytics provider, has impacted some Pornhub Premium users.”
The company stressed that “this was not a breach of Pornhub Premium’s systems” and that “passwords, payment details, and financial information remain secure and were not exposed.”
PornHub also said that it stopped working with Mixpanel in 2021, which suggests the stolen records date from that period or earlier.
The group known as ShinyHunters has claimed responsibility and is now attempting to extort PornHub. They say they possess about 94GB of data containing more than 200 million analytics records showing what users searched for, watched, and downloaded.
Their messages to affected companies begin with “We are ShinyHunters” and threaten to publish the information if no ransom is paid.
Samples of the stolen material reportedly include highly specific details such as a user’s email address, what videos they viewed, related search keywords, and timestamps.
This data reveals just how much personal insight can be derived from seemingly routine analytics logs.
Mixpanel denies that the breach is connected to its November 2025 incident.
In a statement, the company said, “Mixpanel is aware of reports that Pornhub has been extorted with data that was allegedly stolen from us. We can find no indication that this data was stolen from Mixpanel during our November 2025 security incident or otherwise.”
It added that the data “was last accessed by a legitimate employee account at Pornhub’s parent company in 2023.”
This breach highlights a growing privacy concern beyond PornHub itself. Governments in several countries have pushed for mandatory age verification systems for adult websites, often requiring users to provide government-issued identification.
More: Tea App Leak Shows Why UK’s Digital ID Age Verification Laws are Dangerous
Supporters argue it protects minors, but events like this show the real danger: the more information websites are forced to collect, the greater the harm when that information is exposed.
If a site holding only email and activity data can cause this much damage when breached, the outcome would be far worse if those records were tied to verified names or IDs.
Centralized identification systems create a permanent risk of exposure. Even data collected years ago can reappear in criminal hands, leaving users with no practical way to erase their digital footprint.
