Who are ‘ShinyHunters’? Hacker group threatens to expose Pornhub premium users

‘ShinyHunters’, the hacking aggroup, said on tues that it had stolen information of insurance premium customers of Pornhub, and threatened to publish it. The world's leading sex website, earlier this month, released their year-in-review, based on search data on the site.

The news of the hack was confirmed by Reuters who couldn't establish the scope, scale, or details of the breach. However, the hackers provided a sample of their data which was authenticated by the agency.

At least three former Pornhub customers, two from Canada and one from the US, confirmed that their data was authentic but many years old.

Given the sensitivity of the matter, here's all you need to know about the hacking group, ‘ShinyHunters’.

‘ShinyHunters’ is a group of cybercriminals who gained limelight after a Google Threat Intelligence Report alerted about a hacking group that was targeting Gmail users. They rose to fame in 2020 and reportedly carried out 91 successful attacks.

While their primary motive is money, the group is also known for damaging the reputations of several companies. In 2021, they said they were selling data of over 73 million AT&T customers. Tech firms like Salesforce has also been targeted by ‘ShinyHunters’ and over 2.8 million records relating to customers and corporate partners of Allianz Life were released. Groups like these reportedly use voice-based social engineering attacks, also called vishing.

This September, the hacking group reportedly stole private details of potentially millions of customers from luxury brands including Gucci and Balenciaga. Companies like Adidas, Chanel, and Tiffany and Co have also reportedly been targeted.

Their demands after the alleged Pornhub hack is ‘a ransom payment in Bitcoin to prevent the publication of [Pornhub] data and delete the data,’ Reuters reported. They shared data of 14 people, out of which the agency was able to match details of six people.

In a December 12 statement, Pornhub disclosed what it said was a recent cybersecurity incident. It reportedly involved third-party data analytics provider Mixpanel and impacted an undisclosed number of Pornhub Premium users. As per the statement the incident took place in Mixpanel’s environment and involved a "limited set of analytics events for some users."

Mixpanel, which offers its clients detailed visibility into user data and activities, also disclosed a cybersecurity incident on November 27.

The company stated it was aware of Pornhub’s statement, but could ‘find no indication that this data was stolen from our November 2025 security incident or otherwise’, as per Reuters.

The statement further elaborated that Pornhub’s data with Mixpanel was last accessed by “a legitimate employee account at Pornhub’s parent company in 2023." “If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel," the statement also noted.

---

---