Vimeo Confirms Unauthorized Access to User Data After Anodot Breach

Summary

Vimeo says an unauthorized actor accessed some customer and user data following the Anodot breach. The data mainly included technical details, video titles, metadata and some email addresses; Vimeo disabled the integration and is investigating.

Key points

Vimeo disclosed that an unauthorized actor accessed certain customer and user data following the Anodot breach.
Vimeo said the accessed information mainly consisted of technical data, video titles and metadata, with some customer email addresses.
ShinyHunters claimed data from Vimeo’s Snowflake and BigQuery instances and threatened to publish it unless Vimeo paid a ransom.
Vimeo said uploaded video content, account credentials and payment card information were not exposed; platform operations were unaffected.
Vimeo disabled Anodot credentials, removed the integration and is investigating with third-party security experts and law enforcement.

Article Details

Victim Organization: Vimeo
Incident Type: Unauthorized access to customer and user data following the Anodot breach
Data Types Exposed: Technical data
Video titles
Metadata
Some customer email addresses
Affected Records: Unknown; Vimeo said the amount of data accessed remains unclear.
Affected Data Size: Unknown
Operational Impact: Vimeo said its operations were unaffected. It disabled Anodot credentials, removed the integration, and is investigating with third-party security experts and law enforcement.
Ransom Or Extortion: ShinyHunters claimed the incident, listed Vimeo on its extortion portal, and threatened to publish data by April 30 unless Vimeo paid a ransom. The article does not confirm that Vimeo paid or that data was published.
Claim Status: confirmed