Loading story…
Vimeo confirmed that attackers accessed customer and user data through a breach at third-party analytics provider Anodot, exposing about 119,000 unique email addresses and, in some cases, associated names. The stolen information also included technical operational data, video titles, and metadata, while Vimeo said video content, valid login credentials, payment card data, and core platform operations were not affected. The company said the incident did not disrupt service and that the compromise stemmed from vendor access rather than a direct intrusion into Vimeo’s own systems.
The ShinyHunters extortion group claimed responsibility, listed Vimeo on its leak site, and later published a 106GB archive after an alleged pay-or-leak demand failed. Multiple reports said the attackers may have abused Anodot authentication tokens to reach customer cloud environments, including alleged access to Snowflake and BigQuery data tied to Vimeo. Vimeo responded by revoking and disabling Anodot credentials, removing the integration, engaging external forensic experts, notifying law enforcement, and warning users that the exposed contact data could be used in follow-on phishing and social engineering attacks.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned reported that the breach exposed roughly 119,000 unique email addresses, with some associated names, and added about 119,200 affected accounts to its database. This quantified the scope of the exposed user data.
Later reporting said ShinyHunters released at least part of the stolen Vimeo dataset, including a 106GB archive, after extortion attempts failed. The leaked material was described as largely technical data, metadata, video titles, and some email addresses and names.
Multiple reports state that ShinyHunters added Vimeo to its pay-or-leak site in April 2026 after claiming to have stolen data via the Anodot-related compromise. The group threatened to leak the data if a ransom was not paid.
Reporting on the extortion campaign said ShinyHunters threatened to publish Vimeo data by April 30, 2026 if its ransom demand was not met. The group also claimed access to Vimeo-related cloud data through the Anodot compromise.
Following the disclosure, Vimeo said it disabled all Anodot credentials, removed the Anodot integration, engaged external security experts, and notified law enforcement. The company also said the incident caused no service disruption.
Vimeo disclosed that unauthorized access to certain user and customer data occurred through a breach involving third-party analytics vendor Anodot. The company said exposed data mainly included technical data, video titles, metadata, and some email addresses, while video content, valid credentials, and payment card data were not accessed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
11 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open sourceteiss.co.uk
Open sourceuk.pcmag.com
Open sourcetherecord.media
Open sourcevimeo.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SoundCloud confirmed unauthorized access to an internal/ancillary service dashboard that enabled attackers to correlate **hidden email addresses** with information already visible on public SoundCloud profiles, impacting roughly **29.8 million accounts** (about **20%** of its user base). Exposed data was primarily **email addresses** plus public-profile metadata (e.g., usernames/display names, avatars, follower/following counts, and other profile statistics); SoundCloud stated **no passwords or financial data** were accessed. Users also reported service disruptions around the time of the incident, including access issues such as `403 Forbidden` errors (notably when connecting via VPN), consistent with post-incident security changes and response actions. Reporting attributed the intrusion and subsequent extortion attempt to the **ShinyHunters** group, with SoundCloud later acknowledging the actor made demands and used harassment tactics such as **email flooding**. The stolen dataset was subsequently leaked and then added to *Have I Been Pwned* for exposure checking, increasing downstream risk of targeted phishing and account-takeover attempts via credential stuffing on other services where users may have reused emails as identifiers. Separate contemporaneous claims by ShinyHunters against other companies (e.g., Panera Bread, CarMax, Edmunds) were reported but are distinct from the confirmed SoundCloud incident and include different alleged access vectors (e.g., stolen SSO codes).
Jun 29, 2026
The **ShinyHunters** extortion group claimed responsibility for a recent **Okta SSO voice-phishing (vishing)** campaign used to steal authentication codes and access victim environments. The group told reporters and researchers it used vishing to obtain Okta single-sign-on codes to compromise **Crunchbase** and **Betterment**, and then published alleged stolen data after the organizations reportedly rejected extortion demands; ShinyHunters also said additional victims exist and that more disclosures are forthcoming. ShinyHunters published alleged datasets for **Crunchbase, Betterment, and SoundCloud** on a newly launched leak site, asserting the dumps contain **PII** and large record counts (reported as **>20 million** for Betterment, **~2 million** for Crunchbase, and **~30+ million** for SoundCloud). **SoundCloud** stated it is aware of data published online allegedly taken from its organization and said its security team, supported by third-party experts, is reviewing the claim and the posted data; ShinyHunters asserted SoundCloud access was *not* obtained via SoundCloud’s Okta credentials. SoundCloud had previously confirmed a breach affecting roughly **20% of users** (about **28 million** based on public user counts), while Crunchbase and Betterment had not publicly responded at the time of reporting.
Jun 29, 2026
A breach at a third-party SaaS integration provider allegedly exposed authentication tokens that were then used to steal data from more than a dozen companies, with most of the activity targeting **Snowflake** customer environments. Snowflake said it detected unusual activity affecting a small number of customers tied to a specific third-party integration and emphasized that its own platform was not compromised through a vulnerability. Reporting identified the suspected source as **Anodot**, a data anomaly detection company owned by Glassbox, though neither company publicly responded at the time. The threat actor identified as **ShinyHunters** claimed responsibility, saying it stole data from dozens of organizations and sought extortion payments to prevent publication of the information. The campaign reportedly also targeted other cloud and SaaS providers, while an attempted theft involving **Salesforce** was said to have been blocked by AI-based detection. **Google Threat Intelligence Group** said it was tracking the incident, and **Payoneer** said it was aware of the provider breach linked to Anodot but had determined it was not affected.
Jun 29, 2026