ShinyHunters Archives

PornHub is facing extortion after the ShinyHunters gang gained access to historical Premium user data. The breach stems from a previous compromise at Mixpanel, the analytics provider PornHub used until 2021.

Mixpanel suffered a smishing attack on November 8, 2025, which allowed attackers to access systems. PornHub clarified that the exposed data comes from historical analytics records, not its own systems. Passwords, payment information, and other financial data were not affected.

ShinyHunters claims to have obtained 94 gigabytes of data containing more than 200 million records. The information includes email addresses, search history, video watch and download activity, video names, associated keywords, and timestamps.

A sample of the leaked data reviewed by BleepingComputer shows sensitive activity that users would expect to remain private. ShinyHunters confirmed that this is part of a larger trend in 2025, having also targeted Salesforce integration companies, Oracle E-Business Suite, and other analytics platforms.

The group is now creating a ransomware-as-a-service platform called ShinySpid3r. It will allow affiliates, including those connected to Scattered Spider, to conduct ransomware attacks.

For everyday users, this breach highlights how digital footprints can remain exposed years after the fact. Even historical analytics data can be weaponized by cybercriminals. Companies are custodians of this information, but breaches show that the responsibility to protect it extends beyond the moment data is collected.

Email inquiries to hello@laterstack.com

Related Laterstack Cybersecurity Stories

ICE Expands Cybersecurity Contract to Intensify Employee Surveillance

Airbus Moves Critical Workloads to European Sovereign Cloud Amid Security Concerns

Is Your Vibrator Spying on You? Understanding App-Connected Sex Toy Data

Apple and Google Roll Out Emergency Patches After Active Zero-Day Exploits

Major Gainsight Supply Chain Breach Hits 200+ Companies

SAN FRANCISCO – Google has confirmed that hackers stole Salesforce-stored data from more than 200 companies in a large-scale supply chain hack via apps published by Gainsight, a customer support platform.

Austin Larsen, principal threat analyst at Google Threat Intelligence Group, stated that the company is “aware of more than 200 potentially affected Salesforce instances.”

The breach was claimed by the hacking collective Scattered Lapsus$ Hunters, which includes members of the ShinyHunters gang. The hackers stated they accessed data from major companies, including Atlassian, CrowdStrike, Docusign, F5, GitLab, LinkedIn, Malwarebytes, SonicWall, Thomson Reuters, and Verizon.

How the Hackers Gained Access

The hackers reportedly leveraged a prior campaign against Salesloft, which provides AI-driven marketing tools like Drift. They stole authentication tokens from Salesloft customers, allowing them to break into linked Salesforce instances through Gainsight.

“Gainsight was a customer of Salesloft Drift, they were affected and therefore compromised entirely by us,” said a spokesperson for ShinyHunters.

Salesforce confirmed the breach did not stem from vulnerabilities in its platform and has temporarily revoked active access tokens for Gainsight-connected apps as a precaution. Gainsight is collaborating with Google’s incident response unit, Mandiant, to investigate the incident.

Company Responses and Mitigation Efforts

Several affected companies provided statements on their current security posture:

CrowdStrike: Not affected; terminated a suspicious insider.

Docusign: No evidence of compromise; terminated Gainsight integrations and contained data flows.

Verizon & Thomson Reuters: Actively investigating.

Malwarebytes: Aware and investigating Gainsight/Salesforce issues.

Salesforce has stated it is following its policy of not commenting on specific customer cases.

Hacker Extortion Plans

The Scattered Lapsus$ Hunters collective has a history of data theft and extortion campaigns. Following the breach, they announced plans to launch a dedicated website to extort victims, mirroring tactics used in the October Salesloft incident. The group has previously targeted high-profile companies including MGM Resorts, Coinbase, and DoorDash.

These groups rely on social engineering and other techniques to compromise corporate systems, emphasizing the growing threat of sophisticated supply chain attacks in the cybersecurity landscape.

Looking Ahead

This incident highlights the risks of third-party software in enterprise environments, especially platforms connected to cloud services like Salesforce. Companies are advised to monitor unusual activity, enforce strict access controls, and coordinate with incident response teams to mitigate further exposure.