Animoto Data Breach (2018): What Was Exposed & What To Do

Animoto, the cloud-based video creation service, was subject to a data breach reported on July 10, 2018. The incident affected 22.4 million individuals and exposed email addresses, names, dates of birth, geographic locations, and passwords stored as salted hashes. The scale of the exposure places the event among larger service-account compromises of that period. Public records confirm the presence of 22 million unique email addresses in the data set, along with the additional fields noted above.

What happened

In July 2018 Animoto suffered a data breach that was publicly reported on July 10 of that year. The breach exposed records belonging to 22.4 million people, including 22 million unique email addresses together with names, dates of birth, country of origin, and salted password hashes. No further technical details about the intrusion method, duration, or exact volume of records have been disclosed in available reporting.

How a breach like this happens

Incidents involving the extraction of user-account data from online services commonly begin with the compromise of a web application or database server. Attackers may exploit unpatched software, weak authentication controls, or stolen administrative credentials to reach stored records. Once inside, they copy files containing account information and later publish or sell the material. The presence of salted password hashes indicates that passwords were not stored in plain text, yet the hashes remain subject to offline cracking attempts if the salt values and any iteration counts are also obtained.

Animoto and its sector

Animoto operates a cloud platform that allows users to assemble and share videos from uploaded images, clips, and music. Services of this type maintain accounts tied to personal contact details, demographic information, and authentication credentials so that users can access projects across devices. Because the platform stores media linked to identifiable accounts, a breach can connect email addresses and locations to content that users may regard as private.

What was likely exposed

The reported data types include dates of birth, email addresses, geographic locations, names, and passwords stored as salted hashes. These fields match the information typically collected during account registration and profile completion on video-creation platforms. The exact contents of every record remain unconfirmed beyond the categories listed in public breach summaries; no additional data elements have been disclosed.

Why it matters

Exposure of names, dates of birth, and locations can facilitate targeted phishing or identity-verification fraud when combined with other available data sources. Email addresses paired with password hashes increase the chance that reused credentials will be tested against other online services. For Animoto, the incident highlights the long-term storage of account data that retains value to third parties even years after collection.

What to do if you're exposed

Individuals who held Animoto accounts in 2018 should change the password on that service and on any other site where the same password was used. Enabling multi-factor authentication on email and other important accounts reduces the risk of unauthorized access. A free exposure scan of an email address against known breach data sets can indicate whether the address has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.