Vimeo vimeo.com Vimeo data breach: what happened and what to do
In April 2026, the ShinyHunters extortion group leaked data taken from Vimeo through a third-party analytics vendor. It included 119,167 unique email addresses, sometimes with names. Vimeo says video content, valid logins and payment card details were not involved.
View all 13,115 breaches- Breach date
- 28 Apr 2026
- Affected
- 119,167
- Data exposed
- Email addresses, Names
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In April 2026, the ShinyHunters extortion group listed Vimeo on its extortion portal as part of a "pay or leak" campaign. The group then published hundreds of gigabytes of data. Most of it was video titles, technical data and metadata.
Buried in that dump were 119,167 unique email addresses, some of them paired with names. Have I Been Pwned added the breach in May 2026.
Vimeo says the exposure came from a breach of Anodot, a third-party analytics vendor, not from its own systems being broken into directly. The company also says the incident does not include Vimeo video content, valid user login credentials or payment card information. It revoked Anodot's access as part of its response.
What the exposed data lets criminals do
An email address and a name are enough to send a convincing phishing message. Expect emails that mention Vimeo, a video you uploaded or an account problem, with a link to a fake login page. Nothing in this breach includes passwords, so the risk is mostly someone tricking you into handing one over.
What Vimeo has said
Vimeo has published a notice about the Anodot incident. Check it on Vimeo's own site rather than following a link in an email.
What to do if you were in it
- 1
Treat Vimeo emails with suspicion
Don't click links in messages about your Vimeo account or videos. Open vimeo.com yourself and check there.
- 2
Change your Vimeo password if you reuse it
Vimeo says valid logins weren't involved, but a unique password per site limits the damage from any future leak. Turn on two-factor authentication.
- 3
Watch for phishing that uses your name
A message that greets you by name and mentions video hosting is more believable than a generic one. Report it and delete it.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you know what to change. It can't remove data from a breach, but it tells you what to do next.
Frequently asked
Was I affected by the Vimeo data breach?
Have I Been Pwned lists 119,167 email addresses from this breach. You can search your address on the site, or run a free Serus scan.
What was exposed in the Vimeo data breach?
Email addresses and, in some cases, names. The rest of the leaked data was mostly video titles, technical data and metadata.
Were Vimeo passwords or payment cards exposed?
Vimeo says the incident does not include valid user login credentials or payment card information.
Should I change my Vimeo password?
It's not required by what was exposed, but changing a reused password and turning on 2FA is cheap protection.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
