The ShinyHunters extortion gang breached Vimeo by exploiting a vulnerability in Anodot, a third-party data anomaly detection company. This supply chain attack led to the exfiltration of 106GB of data from Vimeo's Snowflake and BigQuery instances, exposing personal information of 119,200 people.
Initial Access
Third-Party Compromise
confirmed
The ShinyHunters threat group gained unauthorized access to Vimeo's systems through a breach at Anodot, a data anomaly detection company integrated with Vimeo.
Defender cut points
Implement a robust third-party vendor risk management program, including regular security assessments, contractual security requirements, and strict access controls for integrated services.
