Hackers breached Pornhub and threatened to expose users' viewing habits

A hacker group that includes members of the collective that hacked Ticketmaster last year says it has collected user data from PornHub and is demanding the company pay an undisclosed amount or it will release detailed information about its users.

The hack was part of a larger breach at Mixpanel, a widely-used web and mobile analytics company. PornHub said in a statement the hack only impacted Premium users, but was not a breach of its Pornhub Premium systems. Data such as passwords, payment details and financial information was not exposed, it said.

That would be good news for most other companies, but a report on BleepingComputer says the hackers apparently have information that could be highly embarrassing for users, including their registered email addresses and location; which videos and channels they watched; keywords associated with the video; and when the video was watched.

A representative of the hacker group said it had sent an extortion email to Pornhub. The company declined to comment about that attempt.

The Mixpanel breach was discovered on Nov. 8, impacting OpenAI and other corporate customers. The data stolen from impacted companies likely varies by company – and it's not clear how many Mixpanel customers were impacted.

ShinyHunters is a black-hat group that’s well known in the cybersecurity world, with a long history of attacks. In the past, it has offered information from companies including AT&T $T (with information on 70 million wireless customers, including social security numbers), Microsoft $MSFT (where it stole source code from a private GitHub account) and Bonobos (where it gained access to personal data for 7 million customers).

The Federal Bureau of Investigation has an ongoing investigation into the group, which last year resulted in the sentencing of one member, who faced three years in prison and was ordered to return $5 million.