Zürich/Silicon Valley – It is the worst-case scenario for millions of Pornhub users: The hacker group ShinyHunters has stolen 200 million premium user data and is now threatening with extortion! Affected: search histories, watchlists, download activities, email addresses – everything available on the dark web. Swiss users are also affected!

The hack: What was stolen? The stolen data includes:

Email addresses of premium users. Search histories – every single search documented. Viewing history – which videos were watched and for how long. Download activities – what was downloaded. Timestamps – when was what done. The data allegedly comes from a Mixpanel security breach from November 2025. Mixpanel is an analytics tool that Pornhub used for user tracking.

ShinyHunters: The notorious hacker group. ShinyHunters is no stranger – the group has already:

Hacked Microsoft. Stolen AT&T customer data. Extorted numerous companies. Their trademark: Bitcoin extortion. Now they are demanding ransom from Pornhub – otherwise, they will publish the data in full.

Pornhub reacts: "Core systems not affected." Pornhub confirms the incident but downplays it: "The core systems of our platform are not affected. The data comes from an old Mixpanel integration."

But for those affected, this is cold comfort. Their most intimate preferences are now on the dark web – and can be used against them.

Sextortion wave threatens: "Pay or we will tell your wife!" Pornhub is already warning its users about a sextortion email wave:

"Expect extortion emails. Criminals will try to extort you with your stolen data. DO NOT pay!"

The typical scheme:

Email to the victim: "We know what you watched. Here is your search history." Present evidence: Real data from the leak. Extortion: "Pay 500 dollars in Bitcoin – otherwise, we will inform your family/employer." Swiss affected: What to do? For Swiss users:

Change your password immediately – not just on Pornhub, but everywhere the email is used. Enable two-factor authentication. DO NOT respond to extortion emails. DO NOT pay Bitcoin – it will not stop the extortionists. Inform authorities in case of specific threats. The Zurich Cantonal Police confirms: "We have received initial reports from those affected. Anyone being extorted should contact us."

Mixpanel denies responsibility. Mixpanel, the analytics tool, denies that the data comes from them: "We are aware of the reports. But we deny that the Pornhub data comes from our November breach."

However, the evidence is clear: The data structure matches Mixpanel logs. Experts are convinced: The data is real.

200 million users: The scale is gigantic. For comparison:

Netflix: ~230 million subscribers worldwide. Spotify: ~600 million users. Pornhub Premium: ~200 million stolen data. The leak affects years of user activity – some data goes back to 2020. Anyone who was a premium user during this time is potentially affected.

The dark figure: Many are unaware of the leak. The problem: Many users do not even know that their data has been stolen. Pornhub has not sent individual notifications. Those who do not read news sites will only find out when the extortion email arrives.

Forbes warns: "Pornhub user data is now in criminal hands. Sextortion waves are programmed."

What Pornhub should have done – and did not do. Experts criticize:

No proactive user notification, No mandatory password resets, No transparent communication about the extent, Mixpanel integration not disconnected in time. Conclusion: 200 million Pornhub users are victims of the mega leak – their most intimate data on the dark web. Swiss affected. Sextortion wave is rolling in. Anyone who was a premium user: change your password, be prepared for extortion emails, do not pay!

Are you affected? Here’s how to check it seriously.

Important context upfront: Pornhub (Aylo) has never officially confirmed a breach of this magnitude. Security researchers (including Troy Hunt from Have I Been Pwned) assess the circulating dataset as likely scraped or as a re-upload of older leaks – not necessarily as a fresh DB dump. The number 200 million roughly corresponds to all accounts ever registered since 2007 – a classic indicator of aggregated data.

Step 1: Have I Been Pwned (free, serious)

Go to haveibeenpwned.com and enter your email address. The service from security researcher Troy Hunt has been collecting all confirmed data leaks worldwide since 2013. If your address appears in a verified Pornhub dataset, it will be displayed here.

As of today, there is no verified Pornhub breach listed on HIBP – this is the strongest indication that the "200 million" story currently consists of aggregated sources.

Step 2: Mozilla Monitor (alternative)

monitor.mozilla.org uses the same HIBP database but additionally provides proactive notifications when your address appears in a future leak.

What you should absolutely not do

  • No Telegram bots or dark web lookup sites – almost always phishing or malware droppers.
  • No "Free Leak Download" forums – usually trojans.
  • No paid lookup services – most just scrape HIBP and sell the same result at a higher price.

If you might really be affected

  • Change your password immediately – and if you reused it elsewhere, do so there as well.
  • Enable two-factor authentication (app, no SMS).
  • Use a password manager (Bitwarden, 1Password, KeePass).
  • Use email aliases (Firefox Relay, SimpleLogin) – this way, you can assign a unique address for each service and deactivate them individually in case of a leak.
  • Ignore extortion emails, never pay. Most "sextortion" messages are generic mass sends without actual data behind them.