7 ms·

Pornhub extorted after hackers steal Premium member activity data

164 points by coloneltcb 10mo ago

nusl 10mo ago
Misleading title; a supplier of theirs was compromised.
- thuridas 10mo ago
  But that transferred very sensitive data to a third party without anonymising the amount. Just by replacing the email with a random anonymizedAccountId the impact would have been reduced from disaster to who cares. This was bad design from the start. We may see some interesting news in a few days.
  - 8cvor6j844qw_d6 10mo ago
    > We may see some interesting news in a few days. Similar to Ashley Madison data breach, vulnerable to extortion and various shenanigans.
    - jimt1234 10mo ago
      I get these spam emails all the time. Some "hacker" has my Pornhub history. They even have video (they "hacked" my laptop camera) of me, uh, enjoying myself. They're gonna leak all of it if I don't send them Bitcoin. I think it's hilarious because I'll provide that data to anyone who asks - no need for "hacking". But I'm 100% confident no one wants that data. LOL
      - NetOpWibby 10mo ago
        LMAO!! Enjoy the free show buddy
  - xp84 10mo ago
    Just mind-bogglingly stupid to send anything about users other than a UserID number/UUID to your web tracking software. Of course, in a sensitive situation such as that, even IP address can also be problematic, and your 3rd-party tracking software vendor gets that automatically. If these clowns had hired someone smart instead of just copy-pasting some tracking code and throwing their whole user object at it or whatever, they would have given this some thought. I'd have used the ability to proxy the MP tracking calls to my own server which most of these services offer but few use. That server would not keep any logs and would perform coarse GEOIP, remove the IP itself or zero the last 2 octets, and relay that information into MixPanel using custom attributes. Just a quick back-of-napkin sketch, but even that was more thought than they put into it.
cmiles8 10mo ago
More Mixpanel shenanigans.
jfindper 10mo ago
>ShinyHunters I had an inkling! They've been on a roll this past year or so. >This data includes a PornHub Premium member's email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. Well, that's pretty fucking wild! Email address & time and location sent to a 3rd party, nice! Absolutely no reason for that, of course. Especially considering these are paying customers! I guess somewhat notably is Mixpanel denying that it's coming from their November breach. They have less incentive to lie in this case, given that they've already admitted to being breached, and (presumably) their systems & logs have been gone over with a fine-toothed comb to identify all affected parties: >"The data was last accessed by a legitimate employee account at Pornhub’s parent company in 2023. If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel."
- znpy 10mo ago
  >This data includes a PornHub Premium member's email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. I had always known, albeit intuitively, that registering to porn websites was a dumb idea. Time has proved me right.
  - bena 10mo ago
    I mean, no shit. Getting compromised is more of a matter or time than ability. Someone's going to fuck up at some point.
  - nephihaha 10mo ago
    I suppose it depends on a) what kind of content and b) your lifestyle otherwise.
  - dredmorbius 10mo ago
    Time proved you right long ago. See the Ashley Madison breach (2015): <https://www.wnycstudios.org/podcasts/otm/segments/what-can-we-learn-ashley-madison https://www.wnycstudios.org/podcasts/otm/segments/what-can-w...> (audio and transcript). Based on Paul Ford's blog entry: "Fairly Random Thoughts on Ashley Madison & the Swiftly Moving Line" <https://medium.com/message/fairly-random-thoughts-on-ashley-madison-the-swiftly-moving-line-a3f48bc309ec https://medium.com/message/fairly-random-thoughts-on-ashley-...>.
temptemptemp111 10mo ago
[dead]
dihsgitt 10mo ago
[flagged]
- standardUser 10mo ago
  [dead]
neilv 10mo ago
I wonder what will be the watershed lawsuit event that makes tech companies consider capturing and holding PII to be liabilities.
- schoen 10mo ago
  I believe Bruce Schneier suggested more than twenty years ago now that we think of personal data as like a form of toxic waste or pollution, but this metaphor doesn't seem to have caught on widely.
  - yakshaving_jgt 10mo ago
    I thought you were thinking of this: https://youtu.be/GAXLHM-1Psk?si=hVjBZNsmmdh-P9n8 https://youtu.be/GAXLHM-1Psk?si=hVjBZNsmmdh-P9n8 Brilliant talk.
- xethos 10mo ago
  Agreed, but this was search and watch history. I can see an argument for not keeping search history, but if I'm paying for Spotify, YouTube, or Netflix, I'd like to go back to that song or video I enjoyed last week but can't recall the name of In other words, this is data we as consumers want to be able to access, and therefore want kept.
  - MangoToupe 10mo ago
    > but if I'm paying for Spotify, YouTube, or Netflix, I'd like to go back to that song or video I enjoyed last week but can't recall the name of Surely this is up to the client, or perhaps explicit bookmarking capabilities. Not implicit records of what you looked for in the past
    - dkokelley 10mo ago
      You CAN turn off watch history in Youtube (not sure about Spotify). However, for better or worse revealed preferences seem to show that people prefer automatic content recommendations over doing the search & bookmark work themselves.
aussieguy1234 10mo ago
Anyone who used their personal or work email to sign up to a site like pornhub should expect that email to be made public one day along with any other data they have on the site, including watch history. In the case of personal emails, that same email can usually be used to look up the victim on social media (Facebook is an example) to reveal their identity, if, like most people, they used the same email on that social media site. As most on HN will be aware, data breaches like this are extremely common. Its not a matter of if, its a matter of when. NSFW sites in particular are more juicy targets and often have bad security.
- userbinator 10mo ago
  work email to sign up to a site like pornhub Unless you actually work in the adult entertainment industry, that seems like a massively stupid move; one that would likely lead to termination.
  - technion 10mo ago
    Honestly...be responsible for mail for at a large enough enterprise and all I can say is you'd be surprised how many people make work emails their only emails.
    - userbinator 10mo ago
      With or without a policy along the lines of "your work email is only for business purposes; any other use is strictly prohibited"?
- rgmerk 10mo ago
  You might know that. I might know that. I can assure you that there are lots of people out there who don't realise it.
nullorempty 10mo ago
1. take emails from other breaches 2. make files similar in structure to the ones leaked with junk links 3. flood internet with this junk data 4. problem solved
alsetmusic 10mo ago
I feel extremely fortunate that I am unashamed of my sexuality, sex drive, or sexual interests. While I'd prefer that my porn history remain private, if anyone ever tried to shame me for it, I'd have no problem telling them I own my human desires. Now, if I was a repressed person living in an area where that threatened my safety, I'd be terrified. It's a privilege that I don't have to worry about it, and that's the real problem when we get past the technical reasons why this shouldn't have happened.
- mystraline 10mo ago
  > While I'd prefer that my porn history remain private Thats a problem as well. Right now, you're 'safe'. But having that data available attached to you can also be dangerous to you in the future. For example, the current wave of trans-hate can easily show you as a sympathizer. That can be criminalized quite easily, given 1/4 of the country hates trans people existing. Being gay is right now not a crime in the USA, but it has been. And many regressive countries, predominantly Muslim, also have strong punishments for gay actions. Again, this material could easily be proof of a "deviant lifestyle" and legal punishments. No, if I consume porn, I download from Piratebay, or hop on VPN and not login. And given I live in a state that Pornhub banned due to onerous age verification/identity tying, the whatif above could easily become true. Ive read Project2025 and saw those exact plans.
  - WillPostForFood 10mo ago
    That can be criminalized quite easily How exactly could trans sympathy be "criminalized"?
    - nkrisc 10mo ago
      Declare “trans” a terrorist organization.
      - deleted 10mo ago
        [deleted]
      - deleted 10mo ago
NetOpWibby 10mo ago
My 2021 watch history? Oh no!
rjdj377dhabsn 10mo ago
Why are so many people paying for premium or even making an account at all? The amount and variety of free porn is already enormous.
- D-Machine 10mo ago
  Yeah, if users end up paying for this leak, this unfortunately ends up, practically, being a stupidity tax... EDIT: Best argument for paying for porn is to support the performers, but paying for a generic porn streaming service hardly seems the best way to do this.
- lisp2240 10mo ago
  Why do you have a HN account? The internet is full of words.
  - Beijinger 10mo ago
    I can't post on HN without an account. How many people upload videos there? (Assuming that it is even possible for an average joe to upload porn there).
  - D-Machine 10mo ago
    An HN account also doesn't even require a verified e-mail...
    - adithyassekhar 10mo ago
      Why haven't we've been flooded with spam yet?
      - recursivecaveat 10mo ago
        Just too small I think. It's neither hosted on a common forum software or worth targeting specifically. If you turn on `showdead` in your profile you can see the caught spam. It's usually pretty thin on the ground, and when it does it occur there's almost no diversity, suggesting just 1 bot source being interested in the site at a time.
hereme888 10mo ago
"I know what you did last summer"
- deleted 10mo ago
  [deleted]
rkagerer 10mo ago
Forget the breach, what are they doing allowing a third party like Mixpanel access to such sensitive data in the first place? I always teach companies to treat user information as somewhat toxic (i.e. a liability). Search and view history... it doesn't get much more personal than this.
dyl000 10mo ago
if you have an account on a porn site you were a lost cause anyways.
- rurban 10mo ago
  With an anonymous name and a throwaway email of course.
beAbU 10mo ago
Don't send PII to mixpanel, kids! It's not a CRM and should not be treated as such. Why people do this is beyond me.

164 points by coloneltcb 10mo ago

nusl 10mo ago

Misleading title; a supplier of theirs was compromised.

thuridas 10mo ago
But that transferred very sensitive data to a third party without anonymising the amount. Just by replacing the email with a random anonymizedAccountId the impact would have been reduced from disaster to who cares. This was bad design from the start. We may see some interesting news in a few days.
- 8cvor6j844qw_d6 10mo ago
  > We may see some interesting news in a few days. Similar to Ashley Madison data breach, vulnerable to extortion and various shenanigans.
  - jimt1234 10mo ago
    I get these spam emails all the time. Some "hacker" has my Pornhub history. They even have video (they "hacked" my laptop camera) of me, uh, enjoying myself. They're gonna leak all of it if I don't send them Bitcoin. I think it's hilarious because I'll provide that data to anyone who asks - no need for "hacking". But I'm 100% confident no one wants that data. LOL
    - NetOpWibby 10mo ago
      LMAO!! Enjoy the free show buddy
- xp84 10mo ago
  Just mind-bogglingly stupid to send anything about users other than a UserID number/UUID to your web tracking software. Of course, in a sensitive situation such as that, even IP address can also be problematic, and your 3rd-party tracking software vendor gets that automatically. If these clowns had hired someone smart instead of just copy-pasting some tracking code and throwing their whole user object at it or whatever, they would have given this some thought. I'd have used the ability to proxy the MP tracking calls to my own server which most of these services offer but few use. That server would not keep any logs and would perform coarse GEOIP, remove the IP itself or zero the last 2 octets, and relay that information into MixPanel using custom attributes. Just a quick back-of-napkin sketch, but even that was more thought than they put into it.

cmiles8 10mo ago

More Mixpanel shenanigans.

jfindper 10mo ago

>ShinyHunters I had an inkling! They've been on a roll this past year or so. >This data includes a PornHub Premium member's email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. Well, that's pretty fucking wild! Email address & time and location sent to a 3rd party, nice! Absolutely no reason for that, of course. Especially considering these are paying customers! I guess somewhat notably is Mixpanel denying that it's coming from their November breach. They have less incentive to lie in this case, given that they've already admitted to being breached, and (presumably) their systems & logs have been gone over with a fine-toothed comb to identify all affected parties: >"The data was last accessed by a legitimate employee account at Pornhub’s parent company in 2023. If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel."

znpy 10mo ago
>This data includes a PornHub Premium member's email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. I had always known, albeit intuitively, that registering to porn websites was a dumb idea. Time has proved me right.
- bena 10mo ago
  I mean, no shit. Getting compromised is more of a matter or time than ability. Someone's going to fuck up at some point.
- nephihaha 10mo ago
  I suppose it depends on a) what kind of content and b) your lifestyle otherwise.
- dredmorbius 10mo ago
  Time proved you right long ago. See the Ashley Madison breach (2015): <https://www.wnycstudios.org/podcasts/otm/segments/what-can-we-learn-ashley-madison https://www.wnycstudios.org/podcasts/otm/segments/what-can-w...> (audio and transcript). Based on Paul Ford's blog entry: "Fairly Random Thoughts on Ashley Madison & the Swiftly Moving Line" <https://medium.com/message/fairly-random-thoughts-on-ashley-madison-the-swiftly-moving-line-a3f48bc309ec https://medium.com/message/fairly-random-thoughts-on-ashley-...>.

temptemptemp111 10mo ago

[dead]

dihsgitt 10mo ago

[flagged]

standardUser 10mo ago
[dead]

neilv 10mo ago

I wonder what will be the watershed lawsuit event that makes tech companies consider capturing and holding PII to be liabilities.

schoen 10mo ago
I believe Bruce Schneier suggested more than twenty years ago now that we think of personal data as like a form of toxic waste or pollution, but this metaphor doesn't seem to have caught on widely.
- yakshaving_jgt 10mo ago
  I thought you were thinking of this: https://youtu.be/GAXLHM-1Psk?si=hVjBZNsmmdh-P9n8 https://youtu.be/GAXLHM-1Psk?si=hVjBZNsmmdh-P9n8 Brilliant talk.
xethos 10mo ago
Agreed, but this was search and watch history. I can see an argument for not keeping search history, but if I'm paying for Spotify, YouTube, or Netflix, I'd like to go back to that song or video I enjoyed last week but can't recall the name of In other words, this is data we as consumers want to be able to access, and therefore want kept.
- MangoToupe 10mo ago
  > but if I'm paying for Spotify, YouTube, or Netflix, I'd like to go back to that song or video I enjoyed last week but can't recall the name of Surely this is up to the client, or perhaps explicit bookmarking capabilities. Not implicit records of what you looked for in the past
  - dkokelley 10mo ago
    You CAN turn off watch history in Youtube (not sure about Spotify). However, for better or worse revealed preferences seem to show that people prefer automatic content recommendations over doing the search & bookmark work themselves.

aussieguy1234 10mo ago

Anyone who used their personal or work email to sign up to a site like pornhub should expect that email to be made public one day along with any other data they have on the site, including watch history. In the case of personal emails, that same email can usually be used to look up the victim on social media (Facebook is an example) to reveal their identity, if, like most people, they used the same email on that social media site. As most on HN will be aware, data breaches like this are extremely common. Its not a matter of if, its a matter of when. NSFW sites in particular are more juicy targets and often have bad security.

userbinator 10mo ago
work email to sign up to a site like pornhub Unless you actually work in the adult entertainment industry, that seems like a massively stupid move; one that would likely lead to termination.
- technion 10mo ago
  Honestly...be responsible for mail for at a large enough enterprise and all I can say is you'd be surprised how many people make work emails their only emails.
  - userbinator 10mo ago
    With or without a policy along the lines of "your work email is only for business purposes; any other use is strictly prohibited"?
rgmerk 10mo ago
You might know that. I might know that. I can assure you that there are lots of people out there who don't realise it.

nullorempty 10mo ago

1. take emails from other breaches 2. make files similar in structure to the ones leaked with junk links 3. flood internet with this junk data 4. problem solved

alsetmusic 10mo ago

I feel extremely fortunate that I am unashamed of my sexuality, sex drive, or sexual interests. While I'd prefer that my porn history remain private, if anyone ever tried to shame me for it, I'd have no problem telling them I own my human desires. Now, if I was a repressed person living in an area where that threatened my safety, I'd be terrified. It's a privilege that I don't have to worry about it, and that's the real problem when we get past the technical reasons why this shouldn't have happened.

mystraline 10mo ago
> While I'd prefer that my porn history remain private Thats a problem as well. Right now, you're 'safe'. But having that data available attached to you can also be dangerous to you in the future. For example, the current wave of trans-hate can easily show you as a sympathizer. That can be criminalized quite easily, given 1/4 of the country hates trans people existing. Being gay is right now not a crime in the USA, but it has been. And many regressive countries, predominantly Muslim, also have strong punishments for gay actions. Again, this material could easily be proof of a "deviant lifestyle" and legal punishments. No, if I consume porn, I download from Piratebay, or hop on VPN and not login. And given I live in a state that Pornhub banned due to onerous age verification/identity tying, the whatif above could easily become true. Ive read Project2025 and saw those exact plans.
- WillPostForFood 10mo ago
  That can be criminalized quite easily How exactly could trans sympathy be "criminalized"?
  - nkrisc 10mo ago
    Declare “trans” a terrorist organization.
    - deleted 10mo ago
      [deleted]
    - deleted 10mo ago

NetOpWibby 10mo ago

My 2021 watch history? Oh no!

rjdj377dhabsn 10mo ago

Why are so many people paying for premium or even making an account at all? The amount and variety of free porn is already enormous.

D-Machine 10mo ago
Yeah, if users end up paying for this leak, this unfortunately ends up, practically, being a stupidity tax... EDIT: Best argument for paying for porn is to support the performers, but paying for a generic porn streaming service hardly seems the best way to do this.
lisp2240 10mo ago
Why do you have a HN account? The internet is full of words.
- Beijinger 10mo ago
  I can't post on HN without an account. How many people upload videos there? (Assuming that it is even possible for an average joe to upload porn there).
- D-Machine 10mo ago
  An HN account also doesn't even require a verified e-mail...
  - adithyassekhar 10mo ago
    Why haven't we've been flooded with spam yet?
    - recursivecaveat 10mo ago
      Just too small I think. It's neither hosted on a common forum software or worth targeting specifically. If you turn on `showdead` in your profile you can see the caught spam. It's usually pretty thin on the ground, and when it does it occur there's almost no diversity, suggesting just 1 bot source being interested in the site at a time.

hereme888 10mo ago

"I know what you did last summer"

deleted 10mo ago
[deleted]

rkagerer 10mo ago

Forget the breach, what are they doing allowing a third party like Mixpanel access to such sensitive data in the first place? I always teach companies to treat user information as somewhat toxic (i.e. a liability). Search and view history... it doesn't get much more personal than this.

dyl000 10mo ago

if you have an account on a porn site you were a lost cause anyways.

rurban 10mo ago
With an anonymous name and a throwaway email of course.

beAbU 10mo ago

Don't send PII to mixpanel, kids! It's not a CRM and should not be treated as such. Why people do this is beyond me.