Vimeo data breach: 119K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-05-05
In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their "pay or leak" campaign. They subsequently published hundreds of gigabytes of data, predominantly consisting of video titles, technical data and metadata. The data also included 119k unique email addresses, sometimes accompanied by names. Vimeo attributed the exposure to a breach of Anodot, a third-party analytics vendor, and advised the incident does not include "Vimeo video content, valid user login credentials, or payment card information". Exposed data: email addresses, names. The breach dates from Apr 28, 2026; Have I Been Pwned loaded it on May 5, 2026.
What to do
- If you had a Vimeo account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch