Data such as paid premium memberships and viewing history of the well-known adult website PornHub have been leaked. This is not because PornHub's own internal system was attacked, but because the provider Mixpanel used by the platform was hacked due to security issues and a large amount of data was stolen.
Mixpanel provides services to many technology companies. The currently known leaked data includes OpenAI and a large number of companies using Salesforce CRM systems. The hackers who launched the attack were the ransomware gang ShinyHunters.
In response to the data leak rumors, PornHub stated in its official response:The company has stopped cooperating since 2021, so it is speculated that the stolen data is historical analysis data from 2021 or earlier. Premium members’ passwords, payment information, and financial information remain secure and have not been compromised.
However, PornHub did not disclose the specific data leaks. In fact, the company should know what data leaks were because the ransomware gang has sent a ransom email to PornHub, demanding that PornHub pay a ransom or publish the leaked data.
The extortion gang communicated with the foreign security website BleepingComputer and provided some sample data. The data showed that PornHub sent a large amount of sensitive data to Mixpanel for analysis.Includes PornHub Premium subscriber's email address, activity type, location, video URL viewed, video name, keywords associated with the video, and the time of the incident.
Obviously PornHub Premium users will not want this data to be published, because you only need to check the user's video viewing preferences through their email address, such as whether they are of the same sex or the opposite sex, whether they are regular or exciting. If the data is disclosed, it may lead to the death of some users.
In addition, the data also shows whether the user has watched or downloaded a certain video or browsed a certain channel, as well as the user's active search history, etc., Normally speaking, it is not impossible for platforms to analyze user data to infer preferences for better push, but it is really embarrassing for adult websites to analyze this data, especially when the impact of data leakage is immeasurable.