Vimeo Data Breach (2026): What Was Exposed & What To Do

In April 2026, the ShinyHunters group listed Vimeo on its extortion portal and later published a large volume of data that included 119,000 unique email addresses, sometimes paired with names. Vimeo stated that the exposure originated from a breach at Anodot, a third-party analytics vendor, and confirmed that the published material did not contain video content, valid login credentials, or payment information. The incident matters because email addresses and names are persistent identifiers that can be used for targeted phishing or account takeover attempts even when no passwords are involved.

Inside the incident

On 28 April 2026, ShinyHunters added Vimeo to its extortion site as part of an ongoing “pay or leak” campaign. The group subsequently released hundreds of gigabytes of material consisting mainly of video titles, technical data and metadata. Within that release were 119,000 unique email addresses, occasionally accompanied by names. Vimeo attributed the source of the data to a compromise at Anodot rather than its own systems and stated that no Vimeo video content, login credentials or payment card details were present in the published files. No further details on the initial access method or the precise timing of the Anodot breach have been disclosed.

Inside shinyhunters

ShinyHunters is a known extortion-focused threat actor that maintains a public leak site and uses a “pay or leak” model to pressure organisations. The group typically obtains data through compromises of third-party vendors or cloud storage environments and then lists the affected organisation on its portal before releasing samples or full archives. Its prior activity has involved multiple technology and media companies, with data sets that often include customer contact information alongside operational files. In this case the group’s listing of Vimeo constitutes its claim of responsibility; Vimeo has not confirmed that ShinyHunters itself carried out the initial intrusion.

Who is Vimeo?

Vimeo operates a video hosting and distribution platform used by individuals, businesses and educational institutions to upload, store and share video content. Like other services in this sector, it maintains user account records that routinely include email addresses and names for registration, billing and notification purposes. A breach involving such data is consequential because the platform’s users often include professionals and organisations that rely on the service for internal communications or client deliverables, increasing the value of any exposed contact details to malicious actors.

What was likely exposed

The published data set explicitly contained 119,000 unique email addresses and, in some records, associated names. Vimeo has stated that the material originated from Anodot and did not include video content, valid login credentials or payment card information. The exact scope of additional fields that may have accompanied the emails remains unconfirmed beyond the vendor attribution provided by Vimeo. Organisations of this type commonly store account creation dates, usage logs and billing addresses, but no public statement has verified whether such fields were present in the released files.

What's at stake

Exposed email addresses paired with names can be used to craft more convincing phishing messages or to cross-reference against other data sets in an effort to identify further accounts. Because the addresses belong to individuals who chose to use Vimeo, they may also appear in other services, raising the possibility of credential-stuffing attempts if those users have reused passwords elsewhere. For Vimeo, the incident highlights the supply-chain risk created by reliance on analytics vendors that hold customer-derived data. No evidence has been presented that login credentials or financial information were compromised, which limits the immediate scope of direct account takeover or fraud.

Were you affected?

Individuals can check whether their email address appears in known breach data sets by using a free exposure scan service that queries public breach repositories. If an address is found, standard precautions include monitoring for unsolicited messages that reference Vimeo or Anodot, enabling multi-factor authentication on any accounts that share the same email, and avoiding password reuse across services. Vimeo has not published a dedicated notification portal for this incident; affected users should review any direct communications from the company and consider updating contact preferences if they no longer require the account.

AICompiled with AI assistance from public sources and published under our editorial standards.