Vimeo Blames Anodot Breach for User Data Theft by ShinyHunters

Video hosting platform Vimeo attributed a recent security incident and subsequent user data theft to a breach at Anodot, a third-party business analytics vendor. According to The Record by Recorded Future, a Vimeo spokesperson confirmed that claims by the cybercriminal group ShinyHunters were directly linked to the Anodot compromise. The breach reportedly exposed Vimeo user and customer data, primarily technical data, video titles, metadata, and in some cases, customer email addresses.

Vimeo’s security team stated that upon discovering the incident, they immediately disabled Anodot credentials, removed the integration, and engaged third-party security experts. Law enforcement has also been notified. The Record by Recorded Future noted that ShinyHunters added Vimeo to its leak site, demanding a ransom. Crucially, video content, user logins, and payment card information were not accessed, and Vimeo’s services remained uninterrupted. This incident highlights the critical supply chain risk posed by third-party vendors, even when core systems remain uncompromised.

ShinyHunters has been active, with The Record by Recorded Future linking them to other high-profile attacks in 2026, including McGraw Hill, ADT, and Rockstar Games. The group’s consistent targeting of diverse organizations underscores their persistent threat and the broad impact of their campaigns. Defenders need to recognize that their security perimeter extends far beyond their direct infrastructure.