Vimeo Confirms Data Theft in Attack Involving Analytics Vendor

Summary

Vimeo says attackers accessed technical data, video titles and metadata, and some customer email addresses in an attack involving analytics vendor Anodot. ShinyHunters separately claims the hack and threatens to leak data for ransom.

Key points

Vimeo confirmed hackers stole user and customer data in an attack involving third-party analytics vendor Anodot.
Accessed databases contained technical data, video titles and metadata, and some customers’ email addresses.
Vimeo said video content, valid login credentials, and payment card information were not accessed, and its systems and services were not disrupted.
Vimeo disabled Anodot credentials, removed the integration, and said its investigation is ongoing; law enforcement has been notified.
ShinyHunters claims it obtained data from Vimeo’s Snowflake and BigQuery instances; this claim is separate from Vimeo’s confirmation of data theft.
ShinyHunters threatens to leak files unless a ransom is paid, giving Vimeo until April 30 to respond.

Article Details

Victim Organization: Vimeo
Incident Type: Data breach involving an attack on the third-party Anodot analytics platform; hackers accessed databases containing technical data, video titles and metadata, and some customers’ email addresses.
Data Types Exposed: Technical data
Video titles and metadata
Email addresses of some customers
Operational Impact: Vimeo reported no disruption to its systems or service. It disabled Anodot credentials and removed the integration with its systems.
Ransom Or Extortion: ShinyHunters claimed to have obtained data from Vimeo’s Snowflake and BigQuery instances and threatened to leak files unless a ransom was paid, setting an April 30 response deadline. The article does not report that Vimeo paid or that the files were leaked.
Claim Status: confirmed