يتطلّب الشاينيون البسكوين بعد المطالبة بـ 201 مليون من أقساط المراقبة والبحث

Pornhub did not lose passwords. It did not lose card numbers. It did not lose government IDs. What ShinyHunters says it took is worse for a lot of the people who pay for the site: the map of what they searched, what they watched, when they watched it, and which Premium account the clicks belonged to. The group told reporters it is sitting on about 94 gigabytes and 201 million analytics records and wants Bitcoin not to publish them. Pornhub says the leak came from Mixpanel, a third-party analytics vendor, not from its own login or billing stack. Mixpanel says its November 2025 smishing incident is not the source. That three-way standoff is the story. The data, if it is real, is already gone from whoever held it first.

Reuters was able to partially authenticate some of the stolen rows. BleepingComputer published the extortion pitch. Pornhub posted a notice on December 12, 2025, warning a “limited set” of Premium users that analytics events had been exposed. None of those statements settle the chain of custody. They do settle the risk. Search terms and watch titles tied to an email and a rough location are enough to run a shakedown without ever touching a credit card.

ما يقوله اللصوص

ShinyHunters described the haul as historical search, watch, and download activity for Premium members: customer details, email addresses, locations, video URLs and titles, keywords, activity type, and timestamps. The group put the record count at 201,211,943. That number is not the same as 201 million people. Analytics events stack. One subscriber can generate thousands of rows. The damage does not shrink just because the headcount is smaller than the row count. A single email plus a month of titles is enough to write an extortion note that sounds informed.

Pornhub’s parent, Aylo, has spent years telling advertisers and banks that the platform cleaned up after the 2020 credit-card revolt and the 2021 document-verification reset. A leak of Premium viewing history undercuts that pitch even if the core vault never opened. Intimate telemetry is the product advertisers buy. It is also the product a blackmailer buys.

The company insists passwords, payment data, and identity documents were not in the Mixpanel feed. That is plausible. Analytics tools are built to record behavior, not vaults. It is also the sentence every vendor writes after a supply-chain hit. Affected users should still treat any email that cites a specific video or search as hostile. Do not click a “verify your Premium account” link. Do not pay a stranger who claims to have the file.

إنكار (إكسبانل) و(2021)

Mixpanel disclosed on November 26, 2025, that it had spotted an SMS phishing campaign on November 8 and opened an incident. A “limited set of analytics events” for some customers was affected. OpenAI later said some API users were touched. SoundCloud said roughly 28 million accounts, about a fifth of its base, had data exposed. The pattern fits ShinyHunters’ usual door: smishing or vishing an employee, then walking into a SaaS console that already holds everyone else’s logs.

Mixpanel still denies that the Pornhub file came out of that November case. The company told Reuters it found no sign the adult-site records left in that incident and noted that Pornhub stopped using Mixpanel around 2021. If that cutoff is accurate, any surviving Pornhub rows in Mixpanel’s systems would be historical, not live. Historical can still ruin a person. It also creates a fight over who was supposed to delete the archive when the contract ended.

Security researchers have floated two other explanations that do not need Mixpanel to be lying: a separate phishing hit on an employee who still had old exports, or an insider who walked a dump out the door and sold it under a famous brand. ShinyHunters has an incentive to attach every haul to a known incident. Vendors have an incentive to isolate every haul from their last incident. Users are stuck between those incentives.

The AEGIS Alliance has watched this exact vendor-to-victim hop in other files, including the 700 Credit خرق التمويل الذاتي و بطاقة (ريد) في الخلف الذي جلس في شارات المكتب لسنوات قبل أن يعامله أي شخص على أنه عيب منتج. وتحتفظ الأطراف الثالثة ببيانات مثيرة للاهتمام لأن الأطراف الأولى لا تريد بناء الأدوات. عندما يرتجف الطرف الثالث، يرسل الطرف الأول كتاباً

الذي شيني هانتر هو عندما يكون الشعار على البريد الإلكتروني

ShinyHunters has been a data-theft and extortion brand since about 2019. It does not encrypt hospitals. It steals tables and sells silence. French police arrested four alleged affiliates in June 2025. A French national, Sébastien Raoult, was extradited to the United States years earlier. The brand kept working. Google tracks overlapping crews as UNC6040, UNC6240, and a cluster of related numbers. In 2025 those crews ran a voice-phishing wave against Salesforce customers, tricking staff into connecting a malicious app to corporate CRM instances. Qantas, Allianz Life, luxury houses under Kering, Adidas, and even a Google Salesforce instance showed up in the blast radius. Krebs on Security later documented a leak site that threatened dozens of Fortune 500 names.

The Pornhub job looks smaller than the Salesforce wave and meaner in a different way. CRM dumps are business pain. Watch-history dumps are personal pain. The group told Reuters the Mixpanel incident was the source and that Bitcoin would make the file go away. Paying that bill does not retire a copy. It funds the next one.

نفس أساليب الطاقم ظهرت في تغطية تحالف (إي جي إس) للهجمات الإلكترونية الأخرى من مستودع اعتماد السيارات على نطاق أوسع أخبار القراصنة على خدمات التأجير التي تستأجر الوصول بحلول الأسبوع إنّ الأداةَ تقريباً أبداً a صفر يوم. الأداة رسالة نصية تشبه تكنولوجيا المعلومات

لماذا تحليل الكبار هو فئة خاصة من الأذى

A leaked shopping cart is embarrassing. A leaked week of adult search terms can end a marriage, a clearance, a pulpit, or a campaign. The people most exposed are not anonymous casual visitors. They are Premium subscribers, the cohort that paid and therefore left a stronger identifier. Location fields in analytics packages are often coarse, but coarse is enough when combined with a workplace email.

Privacy advocates have used the incident to argue that behavioral logs for sexual content should not live at a vendor for years after the contract dies. Europe’s regulators already treat sex-life data as a special category under GDPR. A 201-million-row file of titles and timestamps is a test of whether that category means anything when the processor is in another country and the attacker is a Telegram handle.

Users who think they might be in the set should assume phishing will follow. Messages that quote a video title are not proof the sender has the whole dump. They are proof the sender read a sample. Change the email on the account if the address is used anywhere else. Watch bank and identity channels even though cards were supposedly untouched, because credential-stuffing crews will try the address against every other login. Do not negotiate.

(آيلو) لم يقل أنها ستدفع الثمن (ميكسبانيل) لم يقل أنه سيدفع الثمن لا يحتاج أي منهما للدفع إذا كان بإمكانه بيع شرائح الملف إلى محلات ابتزاز أصغر. تلك السوق الثانوية هي الطريقة التي تسافر بها هذه النفايات المؤتمر الصحفي هو الإعلان

The lesson is not “stop using analytics.” Sites will keep measuring. The lesson is that a dashboard built to optimize thumbnails is also a dossier. When that dossier sits at a vendor the customer forgot it still used, the dossier is no longer under anyone’s control. Pornhub can lock its own vault. It cannot unsay a row that left through a side door in 2021 and surfaced under a ransom note in 2025.

تحالف الأغس سيبقي قرصنة و التكنولوجيا مكاتب في موقع التسرب، وبيانات البائعين، وأي منظم يتعامل مع تقييم الراشدين عن بعد كبيانات تسويق عادية. ولا تصل بيانات التسويق العادية عادة إلى عنوان بيتكوين المرفق.