Full Report
Vimeo points finger at analytics supplier Anodot, says no logins or card data were touched
Analysis Summary
# Incident Report: Third-Party Analytics Compromise (Vimeo / Anodot)
## Executive Summary
Vimeo experienced a data breach involving the exposure of approximately 119,000 user email addresses and associated metadata. The incident originated from a compromise of Anodot, a third-party analytics supplier, which allowed the threat actor "ShinyHunters" to access integrated data repositories. No login credentials or financial data were compromised, and Vimeo has since severed the integration.
## Incident Details
- **Discovery Date:** April 2026 (Initial claims by attackers)
- **Incident Date:** April 4, 2026
- **Affected Organization:** Vimeo (via Analytics provider Anodot)
- **Sector:** Technology / SaaS / Video Hosting
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** April 4, 2026
- **Vector:** Third-party vendor integration compromise.
- **Details:** Attackers gained access to Anodot’s systems, which possessed authorized integrations with Vimeo’s data environments.
### Lateral Movement
- **Details:** Using Anodot’s legitimate credentials/integrations, the attackers pivoted into cloud storage environments, specifically targeting Snowflake and BigQuery instances.
### Data Exfiltration/Impact
- **April 2026:** Threat actor group ShinyHunters claimed to have exfiltrated hundreds of gigabytes of data.
- **May 5, 2026:** Data dump confirmed by Have I Been Pwned, revealing 119,300 unique email addresses, names, video titles, and technical metadata.
### Detection & Response
- **Detection:** Attackers publicly listed Vimeo on a "pay or leak" site after failed extortion negotiations.
- **Vimeo Response:** Disabled Anodot credentials, removed the third-party integration, engaged external security firms, and contacted law enforcement.
## Attack Methodology
- **Initial Access:** Supply Chain Attack/Third-Party Compromise (Anodot).
- **Persistence:** Utilization of legitimate API keys or integration credentials.
- **Privilege Escalation:** Not specified, likely leveraged the existing high-level access granted to the analytics service.
- **Defense Evasion:** Use of legitimate third-party service credentials to mask unauthorized access.
- **Credential Access:** Compromise of Anodot service account/integration credentials.
- **Discovery:** Enumeration of connected cloud databases (Snowflake, BigQuery).
- **Lateral Movement:** Third-party integration hopping from vendor (Anodot) to client (Vimeo).
- **Collection:** Gathering technical metadata and customer email lists.
- **Exfiltration:** Transfer of data from cloud instances to attacker-controlled infrastructure.
- **Impact:** Data breach and attempted extortion.
## Impact Assessment
- **Financial:** Undisclosed; impact includes costs for forensics, legal counsel, and potential extortion demands (which were refused).
- **Data Breach:** 119,300 unique email addresses, some names, video titles, and metadata.
- **Operational:** Disruption of analytics services due to the removal of Anodot integration.
- **Reputational:** Public disclosure of user data; association with a high-profile "ShinyHunters" leak.
## Indicators of Compromise
- **Network indicators:** Activity originating from Anodot infrastructure or associated service accounts.
- **File indicators:** Data dumps circulating on "pay or leak" forums attributed to ShinyHunters.
- **Behavioral indicators:** Unusual query volume or export activity from Snowflake and BigQuery instances via the Anodot service account.
## Response Actions
- **Containment:** Immediately disabled all Anodot-related credentials and API keys.
- **Eradication:** Ripped out the third-party integration from the Vimeo ecosystem.
- **Recovery:** Notified affected users and monitored for secondary phishing campaigns.
- **Legal:** Engaged law enforcement and third-party forensics experts.
## Lessons Learned
- **Supply Chain Risks:** Even with a secure perimeter, third-party vendors with high-level access to data warehouses (Snowflake/BigQuery) represent a significant "blind spot."
- **Data Minimization:** Evaluating whether analytics providers require access to PII (like email addresses) or if anonymized technical data would suffice.
- **Negotiation Policy:** The attackers attempted a "pay or leak" scheme; Vimeo's refusal to pay led to the data release but followed standard security best practices regarding extortion.
## Recommendations
- **Principle of Least Privilege:** Audit third-party integration permissions to ensure they only access the specific tables/buckets required for their function.
- **Monitor Service Accounts:** Implement anomaly detection for service accounts, specifically focusing on large-scale data exports or unusual query patterns.
- **Vendor Risk Management:** Require SOC2 reports or independent security audits from all third-party vendors with access to cloud data environments.
- **User Awareness:** Advise users to remain vigilant against phishing, as their emails and associated video interests are now in the public domain.