Vimeo Confirms Data Breach via Third-Party Analytics Vendor Anodot Vimeo has disclosed a data breach stemming from a security incident at Anodot, its third-party business analytics provider. The breach, attributed to the cybercriminal group ShinyHunters, exposed certain user and customer data, though no video content, login credentials, or payment information was compromised. According to Vimeo’s statement, the accessed data primarily included technical metadata, video titles, and, in some cases, customer email addresses. The company responded by revoking Anodot’s access, removing the integration, and enlisting third-party security experts to investigate. Law enforcement has also been notified. ShinyHunters listed Vimeo on its leak site on Tuesday, threatening to release stolen data unless a ransom was paid by Thursday. The group has been linked to a series of high-profile attacks in 2026, including breaches at McGraw Hill, ADT, and Rockstar Games with the latter also tied to the Anodot compromise. Reports suggest a broader supply-chain attack involving Anodot may have exposed data from multiple organizations. Google Threat Intelligence previously detailed ShinyHunters’ tactics, which rely on phishing schemes rather than software vulnerabilities. Despite law enforcement crackdowns in 2025, the group remains active, recently targeting Match Group (owner of Tinder, Hinge, and OkCupid) before shifting focus to its current campaign. The investigation into the Vimeo breach is ongoing.

ShinyHunters Claims Major Data Breach of Udemy, Threatens to Leak 1.4M Records On April 24, 2026, the cybercriminal group ShinyHunters announced a data breach targeting Udemy, one of the world’s largest online learning platforms, alleging the theft of over 1.4 million records containing personally identifiable information (PII) and internal corporate data. The group issued a "Pay or Leak" ultimatum, demanding a response from Udemy by April 27, 2026, or risk public exposure of the stolen data. ShinyHunters, a financially motivated extortion group active since 2019, has built a reputation for high-profile breaches, including the 2020 theft of 200 million records from 13 companies. In 2026 alone, the group has intensified attacks on SaaS platforms and the education sector, with recent victims including Vercel, McGraw-Hill, and Harvard University (where 115,000 alumni records were exposed). Google Threat Intelligence tracks the group under the designation UNC6240, noting its shift from traditional network exploitation to social engineering, MFA bypass, and credential harvesting. ShinyHunters often exploits third-party integrations and compromised vendor credentials, as seen in the Vercel breach, where a third-party vendor (Context.ai) served as the entry point. The education sector remains a prime target, with ShinyHunters previously breaching India’s Unacademy, stealing over 10 million user accounts. As of publication, Udemy has not confirmed or denied the breach, and researchers continue monitoring the group’s leak site for potential data release following the deadline. The incident underscores the group’s evolving tactics and persistent focus on high-value targets.

McGraw-Hill Confirms Data Breach via Salesforce Misconfiguration, Disputes ShinyHunters’ Claims Education giant McGraw-Hill has acknowledged a data breach stemming from a misconfigured Salesforce environment, which allowed hackers to access a limited set of internal data. The company stated that the incident did not compromise its Salesforce accounts, customer databases, or core systems, and that the exposed information was non-sensitive, lacking Social Security numbers, financial details, or student data from its platforms. The breach was first flagged by the extortion group ShinyHunters, which listed McGraw-Hill as a victim on its dark-web portal and threatened to leak allegedly stolen data including 45 million records containing personally identifiable information (PII) by April 14 unless a ransom was paid. McGraw-Hill disputed the group’s claims, asserting that the accessed data was minimal and not critical. McGraw-Hill, a major provider of textbooks, digital learning tools, and K-12/university platforms with $2.2 billion in annual revenue, confirmed that the affected webpages were secured immediately after detecting the unauthorized access. The company is collaborating with Salesforce to reinforce protections and address the misconfiguration, which it described as part of a broader issue impacting multiple Salesforce clients. ShinyHunters, known for high-profile breaches in 2024 including attacks on Rockstar Games, Hims & Hers, the European Commission, and Panera Bread has also targeted other education-related entities, such as Infinite Campus, a K-12 student information system provider, in March. The group’s extortion tactics have raised concerns across industries, though McGraw-Hill’s investigation, supported by external cybersecurity experts, maintains that the incident’s impact was contained.

Sextortion Scammers Exploit ShinyHunters Data Leaks in $2,000 Bitcoin Scheme Cybercriminals are leveraging email addresses from past ShinyHunters data breaches to lend false credibility to a new wave of sextortion scams, demanding $2,000 in Bitcoin from victims. The campaign, reported by BleepingComputer, targets individuals whose personal data was exposed in breaches of companies like Amtrak, Hallmark, ADT, Substack, Betterment, CarGurus, Panera Bread, and McGraw Hill, as well as those affected by the Canvas data breach at a California community college. The scam emails falsely claim to be from ShinyHunters, alleging that the group has compromised victims’ devices, recorded explicit content via webcams, and threatens to leak the footage unless payment is made within 48 hours. A sample email includes a Bitcoin wallet address currently showing no transaction activity and falsely asserts access to browsing history, contacts, and other sensitive data. Despite the threats, no evidence supports the claims. ShinyHunters has denied involvement, and security experts confirm the emails are bluffs, relying on psychological manipulation rather than actual malware or recordings. The scammers likely obtained the email lists from publicly leaked data after ShinyHunters’ failed extortion attempts. The $2,000 demand marks an increase from typical sextortion scams, possibly indicating the scammers acquired the data through purchase or direct download. While the emails vary in sophistication some appearing AI-polished they uniformly lack verifiable proof. Security researchers emphasize that responding to such emails can confirm an active account, leading to further targeting. Victims are advised to ignore the threats, avoid engaging with the scammers, and report the emails as spam. If the message includes a previously used password, users should change it immediately and enable two-factor authentication (2FA). The campaign underscores how leaked data continues to fuel cybercrime, even when the original breach has been addressed.

The cybercriminal group ShinyHunters (operating under the alias Scattered LAPSUS$ Hunters) executed a voice phishing (vishing) campaign in May 2025, tricking employees into connecting a malicious app to their Salesforce portals. This breach led to the theft of over a billion customer records from dozens of Fortune 500 firms, including Toyota, FedEx, Disney/Hulu, and UPS. The group threatened to publicly leak stolen data unless ransoms were paid by October 10, 2025, via a victim-shaming extortion blog. The compromised data included customer engagement records, internal communications, and sensitive business details. Salesforce confirmed the attack but refused to negotiate, stating it would not pay extortion demands. The incident also exposed a broader supply-chain risk, as the group claimed responsibility for stealing authentication tokens from Salesloft (a Salesforce-integrated AI chatbot provider), further expanding the attack surface. The group’s actions were linked to multiple zero-day exploits, including CVE-2025-61882 in Oracle’s E-Business Suite, which they weaponized for additional data theft.