Vimeo Breach Exposed Data of 119,200 People, Have I Been Pwned Reports
Summary
Vimeo confirmed unauthorized data access following an Anodot breach. Have I Been Pwned reported that 119,200 people’s email addresses and some names were exposed; ShinyHunters claimed the theft and posted a 106GB archive.
Key points
- Vimeo said customer and user data was accessed without authorization after a breach at Anodot.
- Have I Been Pwned analyzed the data and reported exposure of 119,200 email addresses and, in some cases, names.
- ShinyHunters claimed responsibility for stealing data and posted a 106GB archive after extortion negotiations failed.
- Vimeo said the accessed data did not include video content, valid login credentials, or payment card information.
- Vimeo disabled Anodot credentials, removed the integration, engaged third-party security experts, and notified law enforcement.
- Vimeo said the incident did not disrupt its systems or services.
Article Details
- Victim Organization
- Vimeo
- Incident Type
- Unauthorized access to Vimeo data after attackers abused Anodot authentication tokens; ShinyHunters later posted an archive of data it claimed to have stolen.
- Data Types Exposed
- Email addresses
- Names in some cases
- Technical data
- Video titles and metadata
- Affected Records
- Have I Been Pwned reported that 119,200 people’s email addresses and, in some cases, names were exposed.
- Affected Data Size
- ShinyHunters posted a 106GB archive it said contained stolen data.
- Operational Impact
- Vimeo said the incident caused no disruption to its systems or service. It said video content, valid login credentials, and payment card information were not exposed. Vimeo disabled Anodot credentials, removed the integration, engaged third-party security experts, and notified law enforcement.
- Ransom Or Extortion
- ShinyHunters said it attempted to extort Vimeo, but the parties failed to reach an agreement; the group then posted the archive on its leak site.
- Claim Status
- confirmed