In December 2025, Pornhub disclosed that some Premium-member data had been compromised through an analytics supply-chain incident. The public story was messy: Pornhub pointed to Mixpanel, Mixpanel disputed that its November 2025 incident was the source, and ShinyHunters claimed responsibility for a much larger cache.
That uncertainty matters. It means users were left with two bad facts at once: their data may have been exposed, and even the path of exposure was contested.
What Was Reported
The scope was described by the attackers and by reporters — it was never confirmed in full by Pornhub. TechRadar reported that attackers allegedly hold 94GB of sensitive records, including emails, activity details, and viewing metadata, and that Pornhub did not disclose how many people were affected or the nature of the information stolen. Reuters reviewed a sample supplied by the hackers and confirmed the identities of three people who had previously been premium members.
The dataset was described as including:
Viewing history and search queries.
Session duration and frequency patterns.
Device fingerprints and IP associations.
Geographic location data.
Behavioral analytics from Mixpanel integration.
The wider user-count estimates that circulated in coverage were never confirmed by Pornhub, which said the incident affected an undisclosed number of Premium users.
Pornhub said passwords, payment details, credentials, and government IDs were not taken. That is good, but it does not make the incident harmless. In the adult industry, viewing metadata is itself sensitive personal data. It can be used for blackmail, outing, harassment, relationship abuse, and targeted scams.
The Incognito Illusion
Many users believe "incognito mode" provides anonymity. It doesn't.
What Incognito Does:
Doesn't save local browsing history.
Doesn't store cookies after session.
What Incognito Doesn't Do:
Hide your IP address.
Prevent website tracking.
Stop third-party analytics.
Protect against data breaches.
Total Surveillance
The deeper issue is not only who broke in. It is that this level of behavioral detail existed in the first place. Analytics pipelines normalize collection first and risk assessment later. By the time someone asks whether the data should exist, it is already in dashboards, exports, vendor logs, and employee workflows.
Defense Protocol
Use a VPN: Hides your IP. We recommend Mullvad (cash payments accepted).
Use Tor: The Tor Browser is the only real way to decouple your identity from your traffic.
Stop Believing in 'Private Mode': It is a UI feature, not a security feature.
Compartmentalize accounts: Do not reuse emails, usernames, passwords, or payment identifiers across sensitive services.
Watch for extortion: If you receive a threat referencing adult-site use, do not pay. Preserve evidence and report it.
Clean Up: Check out our Tools page for localized history cleaners.