Almost 120,000 Vimeo Accounts Exposed in ShinyHunters Data Breach
Published
Key Takeaways
- Extortion campaign listing: In April 2026, ShinyHunters listed Vimeo on its portal, publishing hundreds of gigabytes of enterprise data.
- Third-party compromise: Vimeo attributed the data exposure to a security breach at its third-party analytics vendor, Anodot.
- Data exposure scope: The leak exposed almost 120,000 email addresses but contained no user credentials, payment information, or video content.
In April 2026, the ShinyHunters extortion group targeted Vimeo as part of its ongoing "pay or leak" campaign, listing the video hosting platform on their extortion portal and subsequently publishing hundreds of gigabytes of data.
Breach notification platform Have I Been Pwned (HIBP) added the leaked data on May 5, 2026, confirming that almost 119,200 unique email addresses were involved in the April 2026 breach.
Scope of the Data Exposure
The HIBP dataset predominantly consists of video titles, technical data, and platform metadata. However, the exposure also impacts user data – email addresses, with some records accompanied by user names.
Following the data publication, Vimeo issued a statement clarifying the boundaries of the security incident. The company investigated the incident and attributed the data exposure directly to a security breach at Anodot, a third-party analytics vendor.
ShinyHunters claimed it compromised Snowflake and BigQuery instances, extracting significant volumes of information from the vendor's infrastructure rather than Vimeo's primary internal systems.
Operational Security Impact
Vimeo stated the compromised information does not include any actual Vimeo video content. Furthermore, the exposure did not compromise valid user login credentials or any financial payment card information.
Organizations utilizing third-party analytics vendors must continue auditing supply chain access to secure operational metadata and user contact information.
ShinyHunters last month released 78.6 million internal analytics records, reportedly from a confirmed Rockstar Games data breach linked to Anodot and also listed a Udemy data breach. Other breaches claimed by the threat actor last month include Hallmark and Hallmark+ and a Cisco breach linked to a Trivy compromise.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular