Third‑Party Analytics Breach Exposes 119K Vimeo User Emails and Names
What Happened — In April 2026 the ShinyHunters extortion group listed Vimeo on a “pay‑or‑leak” portal and later published hundreds of gigabytes of data. The breach was traced to Anodot, a third‑party analytics vendor used by Vimeo. Exposed records include 119,167 unique email addresses and associated names; video content, login credentials, and payment data were not compromised.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of relying on external analytics services without continuous oversight and evidence of security controls.
- Highlights the need for a documented third‑party risk‑management program that can provide real‑time assurance evidence for audits.
- Underlines the importance of maintaining a defensible incident‑response trail that captures vendor‑related exposures.
Who Is Affected – Video‑hosting SaaS platforms, their content‑creator customers, and any organization that integrates third‑party analytics services.
Recommended Actions – Review and tighten third‑party risk assessments, ensure contractual security clauses include continuous monitoring obligations, collect and retain evidence of vendor controls, and update incident‑response playbooks to cover supply‑chain exposures. Source: https://haveibeenpwned.com/api/v3/breach/Vimeo
Technical Notes – Attack vector: compromise of a third‑party analytics provider (Anodot). Data types exposed: email addresses and names; no passwords or payment information were disclosed. Source: https://haveibeenpwned.com/api/v3/breach/Vimeo