Vimeo Data Breach Exposes 119,000 User Email Addresses

Key Takeaways

• Video hosting giant Vimeo suffered a data breach impacting 119,000 user email addresses and associated metadata.
• The incident originated from a supply chain compromise involving Anodot, a third-party analytics vendor, not Vimeo’s direct infrastructure.
• The notorious ShinyHunters extortion group claimed responsibility, publishing hundreds of gigabytes of stolen data.
• While sensitive financial information and passwords were not compromised, exposed email addresses pose a significant risk for targeted phishing and credential stuffing attacks.
• Vimeo has severed ties with the compromised vendor and initiated a comprehensive forensic investigation.

Vimeo, the widely used video hosting and sharing platform, has confirmed a significant data breach that exposed the email addresses of 119,000 users. The incident, discovered in April 2026, was not a direct compromise of Vimeo’s systems but rather a result of a security breach at one of its third-party analytics vendors, Anodot.

The infamous extortion group ShinyHunters has taken responsibility for the attack. The group added Vimeo to its public extortion portal as part of its “pay or leak” strategy, subsequently publishing hundreds of gigabytes of stolen data online after the initial threat. Google Threat Intelligence has also issued a report detailing ShinyHunters’ expanding software-as-a-service data theft operations, directly linking the group to this specific vendor compromise.

Vimeo Data Breach Details

While the volume of leaked data is substantial, the content primarily consists of technical records. Exposed databases contained video titles, system metadata, and technical logs. However, the most critical concern for users is the exposure of 119,000 unique email addresses, sometimes paired with usernames. The data breach notification service Have I Been Pwned analyzed and added 119,200 accounts to its database, noting that 56% of these accounts had already appeared in previous breaches. Cybercriminals frequently weaponize this type of personal information to launch highly targeted phishing campaigns or execute credential stuffing attacks across various online platforms.

Vimeo has moved to reassure its user base about the scope of the breach. According to their official security advisory, the unauthorized access did not affect actual Vimeo video content. Furthermore, the company explicitly confirmed that valid user login credentials, passwords, and payment card information remain entirely secure. The incident also did not disrupt Vimeo’s core systems or daily hosting services, ensuring uninterrupted platform operations.

Supply Chain Compromise Root Cause

The root cause of the data exposure stems from a breach within Anodot, a third-party analytics vendor utilized by Vimeo and numerous other organizations. Threat actors successfully infiltrated Anodot’s systems, thereby gaining unauthorized access to specific Vimeo customer data stored within that analytics environment. This indirect compromise underscores the critical importance of robust vendor security oversight and meticulous management of data access permissions within complex enterprise supply chains.

Upon detecting the unauthorized access, Vimeo’s security team immediately activated its incident response protocols. The company promptly revoked all Anodot credentials and completely removed the vendor’s integration from Vimeo’s internal systems to prevent any further data exfiltration. Additionally, Vimeo engaged external third-party cybersecurity experts to assist with a comprehensive forensic investigation. The company has also notified relevant law enforcement agencies and stated its commitment to monitoring the situation and providing updates to users as the ongoing investigation progresses.

What You Should Do

• Be Vigilant Against Phishing: Even though passwords were not exposed, remain highly cautious of any suspicious emails or communications. Threat actors often leverage exposed names and email addresses to craft convincing phishing messages designed to steal credentials or deploy malware.
• Use Strong, Unique Passwords: Ensure all your online accounts, especially those linked to your exposed email, use strong, unique passwords. A reputable password manager can help generate and store these securely, preventing a breach on one platform from compromising others.
• Enable Multi-Factor Authentication (MFA): Activate MFA on all critical accounts, including Vimeo, email, and banking services. MFA adds an essential layer of security, making it significantly harder for attackers to gain unauthorized access even if they obtain your password.
• Monitor Your Accounts: Regularly review activity on your Vimeo account and other online services for any unusual or unauthorized actions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.