(Photo illustration by Cheng Xin/Getty Images)
Video platform Vimeo has suffered a breach involving hacking gang ShinyHunters, which stole a trove of data containing at least some user email addresses.
Vimeo disclosed the breach on Monday. ShinyHunters is trying to extort the platform by threatening to publish the stolen information unless a ransom is paid. “Pay or Leak,” ShinyHunters wrote on the group’s dark web site.
Vimeo has traced the breach to a ShinyHunters attack on Anodot, a business monitoring tool. It stole authentication tokens, creating a pathway to hit other brands, including Rockstar Games, since Anodot can be integrated with Snowflake, a major cloud storage provider.
Vimeo says: “Our initial findings suggest that the databases accessed primarily contain technical data, video titles and metadata, and, in some cases, customer email addresses.” It's unclear how many users are affected, but Vimeo says it has 287 million users.
Fortunately, no user login credentials, payment card information, or video content were affected. “Vimeo user and customer login credentials are secure. This incident did not cause any disruption to our systems or service,” the video hosting company said. Vimeo has also removed its Anodot integration and notified law enforcement.
Still, the breach underscores the persistent threat posed by ShinyHunters, which has been targeting cloud-based software providers to help them access and steal from large databases. The group is known to use English-language voice calls and impersonation, such as pretending to be IT customer support, to trick company employees into handing over internal access.
In the meantime, ShinyHunters is threatening to leak the stolen Vimeo data on Thursday unless the extortion demand is paid. Last week, the group also publicized the theft of 11GB of data from home security provider ADT, which appears to involve the data of 5.5 million users. It's unclear how ADT was breached, but the initial intrusion was detected last week.