Vimeo
Vimeo's Snowflake and BigQuery environments were compromised through a third-party analytics vendor. The attack surface wasn't Vimeo—it was the tools they used to understand their own data.
What happened?
On April 4, 2026, the ShinyHunters extortion group compromised Anodot, a third-party analytics vendor used by Vimeo. Using stolen authentication tokens, attackers accessed Vimeo's Snowflake and BigQuery cloud environments. When ransom negotiations failed, ShinyHunters dumped 106GB of stolen data on their dark web leak site with a message: "Your Snowflake and BigQuery instances data was compromised thanks to Anodot.com."
What data was actually inside?
119,200 unique email addresses. Names for a subset of users. Video titles. Technical metadata. Vimeo confirmed the breach did not include video content, login credentials, or payment card information—but 106GB of data still walked out the door.
Have I Been Pwned noted that 56% of the affected accounts were already exposed in prior breaches. For those users, this is another credential stuffing opportunity. For the other 44%, this is their first appearance in a breach database.
Who gets hurt and how?
Vimeo users include independent filmmakers, businesses hosting product videos, educators sharing course content, and media companies distributing premium content. Their email addresses are now public. Combined with video titles and metadata, attackers know what content each user uploaded or watched.
For creators, this is targeting data. Phishing emails referencing specific videos they uploaded. Impersonation attempts using their content history. For businesses, it's a map of their video marketing operations—which products they're promoting, which training materials they've created, which internal communications they've recorded.
What did they think they were doing right?
Using enterprise cloud infrastructure. Snowflake and BigQuery are industry-standard data platforms with robust security controls. Vimeo didn't store data in some forgotten server—they used the same cloud analytics stack that Fortune 500 companies rely on.
Anodot is a business intelligence platform that helps companies analyze metrics and detect anomalies. To do that job, it needs access to your data. Vimeo gave Anodot authentication tokens for their Snowflake and BigQuery environments because that's how modern analytics integrations work. When Anodot was compromised, those tokens became the attack vector.
What did they not know about their own data?
Vimeo knew Anodot had access to their analytics environments. That's how the integration was designed. What they may not have fully mapped: exactly which user data those environments contained, which tables held email addresses paired with names, which queries Anodot could run against their production data.
106GB is a lot of data. When Vimeo said the breach "does not include video content, valid user login credentials, or payment card information," they were drawing boundaries around what they thought was sensitive. But 119,200 email addresses with names and content metadata was apparently accessible—and apparently not classified as high-risk enough to warrant tighter access controls.
If you use cloud storage, do you know what sensitive data lives in your buckets and blobs? Or would you find out the same way they did?
What does attribution look like the morning after?
Vimeo's response was swift: disable Anodot credentials, remove the integration, engage security experts and law enforcement. But by April 30—three weeks after the breach—ShinyHunters was already threatening to publish if ransom demands weren't met. Negotiations failed. The data went public.
ShinyHunters used the same Anodot pathway to hit Rockstar Games. This wasn't a one-off—it was a campaign. Anodot's customer list became a target list, and each integration was another potential breach waiting to happen.
What would have changed the outcome?
Knowing exactly what sensitive data each third-party integration could access before that access was abused.
Anodot needed analytics access. But did it need access to 119,200 user email addresses? Did it need names? Every third-party integration is a trust decision—and every trust decision should be scoped to the minimum data required for the job.
The organizations that survive vendor compromises are the ones who already know which integrations can reach which data. Not "analytics access to Snowflake"—but exactly which tables, which columns, which user records. That inventory is the difference between a contained incident and a 106GB leak.
Vimeo found out the hard way.
Your team could spend the next 6 months rebuilding systems, notifying customers, and answering legal questions. Or you could spend 24 hours finding out what's actually at risk.