The threat is a supply chain attack via compromised authentication tokens from Anodot, which attackers used to access customer environments, primarily Snowflake, and exfiltrate data. The attack vector exploited stolen credentials from a third-party service provider to breach downstream customers. Vimeo has mitigated the incident by disabling Anodot credentials and removing the service's integration, noting that no video content, account credentials, or payment information was compromised.
Data Security , Supply chain , Breach , Identity Vimeo confirms customer data accessed following Anodot breach April 29, 2026 Share By SC Staff (Credit: Getty Images) Vimeo has confirmed that unauthorized access to some customer and user data occurred as a result of a recent breach at Anodot, a data anomaly detection company. The video platform stated that the exposed information primarily includes technical data, video titles, and metadata, with some customer email addresses also accessed, according to a recent report by Bleeping Computer. The breach was claimed by the ShinyHunters extortion group, which threatened to leak the data by April 30 if a ransom was not paid. ShinyHunters also warned Vimeo of "several annoying digital problems" to come. The attack on Anodot involved attackers stealing authentication tokens, which were then used to access customer environments, primarily Snowflake, and exfiltrate data. This incident follows similar attacks on other organizations, including Rockstar Games. Vimeo has stated that the compromised data does not include video content, account credentials, or payment information, and its operations remain unaffected. The company has disabled Anodot credentials, removed the service's integration, and is investigating the incident with third-party security experts while also notifying law enforcement. Source: Bleeping Computer SC Staff Related Data Security Report: Over 6.5M users’ data peddled by browser extensions SC Staff April 29, 2026 More than 80 browser extensions with over 6.5 million users have been legally selling procured information for profit, reports Cybernews. Data Security Exposed Checkmarx data tied to March supply chain hack SC Staff April 29, 2026 Checkmarx has disclosed that its source code, API keys, MongoDB and MySQL credentials, and other sensitive information exposed by the Lapsus$ hacking operation were obtained from a GitHub repository that was breached as part of a supply chain attack by the TeamPCP threat group last month, according to The Register. Ransomware TeamPCP-linked VECT 2.0 ransomware unintentionally destroys files larger than 128 KB Laura French April 29, 2026 Researchers revealed several “amateur” mistakes made in Windows, Linux and ESXi variants. Related Events Cybercast Beyond the Hype: The Cybersecurity Trends CISOs are Keeping an Eye on in 2026 On-Demand Event Cybercast Beyond the data perimeter: Why next-generation DSPM is the foundation for modern data security On-Demand Event Virtual Conference Securing the Future of Finance: Strategies to Counter Modern Cyber Threats On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Biometrics Bit Certificate-Based Authentication Data Aggregation Data Loss Prevention (DLP) Data Warehousing Digest Authentication Digital Signature Algorithm (DSA) Digital Signature Standard (DSS) Discretionary Access Control (DAC) You can skip this ad in 5 seconds