Vimeo Confirms Data Breach via Third-Party Analytics Vendor Anodot Vimeo has disclosed a data breach stemming from a security incident at Anodot, its third-party business analytics provider. The breach, attributed to the cybercriminal group ShinyHunters, exposed certain user and customer data, though no video content, login credentials, or payment information was compromised. According to Vimeo’s statement, the accessed data primarily included technical metadata, video titles, and, in some cases, customer email addresses. The company responded by revoking Anodot’s access, removing the integration, and enlisting third-party security experts to investigate. Law enforcement has also been notified. ShinyHunters listed Vimeo on its leak site on Tuesday, threatening to release stolen data unless a ransom was paid by Thursday. The group has been linked to a series of high-profile attacks in 2026, including breaches at McGraw Hill, ADT, and Rockstar Games with the latter also tied to the Anodot compromise. Reports suggest a broader supply-chain attack involving Anodot may have exposed data from multiple organizations. Google Threat Intelligence previously detailed ShinyHunters’ tactics, which rely on phishing schemes rather than software vulnerabilities. Despite law enforcement crackdowns in 2025, the group remains active, recently targeting Match Group (owner of Tinder, Hinge, and OkCupid) before shifting focus to its current campaign. The investigation into the Vimeo breach is ongoing.

Medtronic Confirms Cyberattack by ShinyHunters, 9 Million Records Allegedly Stolen Medical device manufacturer Medtronic disclosed a cybersecurity breach last week, revealing that hackers accessed data within its corporate IT systems. The attack was claimed by the notorious extortion group ShinyHunters, which alleged the theft of over 9 million records containing personally identifiable information (PII) and terabytes of internal corporate data. Medtronic, the world’s largest medical device company by revenue ($33.5 billion) with operations in 150 countries, stated that the breach did not affect customer data, patient safety, or its manufacturing and distribution networks. The company emphasized that its product systems, hospital customer networks, and financial reporting infrastructure remained secure and separate from the compromised IT environment. ShinyHunters listed Medtronic as a victim on April 18, threatening to leak the stolen data unless the company engaged in ransom negotiations by April 21. The group’s listing has since been removed from its leak site, though the reason remains unclear. Medtronic is conducting an investigation to determine whether any personal data was exposed and has pledged to notify affected individuals if necessary. While the full scope of the breach is still under review, the incident highlights the persistent threat of data extortion attacks targeting major healthcare and technology firms.

Mailchimp Hit by Everest Ransomware Group in Data Theft Attack The Everest ransomware group has claimed responsibility for a cyberattack on Mailchimp, the direct marketing platform with over 14 million users, including major brands like The North Face, Vimeo, and New Belgium Brewing. On July 31, the group posted details of the breach on its darknet leak site, alleging the theft of 767 MB of data approximately 943,536 lines of information. The stolen data includes internal company documents, client personal information, and corporate details, such as: - Company domain names and emails - Location data and phone numbers - Social media links - GDPR-related labels - Tech stack details of companies like Amazon, PayPal, and Shopify Everest provided two screenshots of the data, which appear to have been exported from a customer relationship management (CRM) platform. Notably, the group has not issued a ransom demand or deadline, and Mailchimp is one of four victims listed on the same day. Everest, a Russian-linked ransomware group active since 2020, initially operated as a data-theft extortion operation before expanding into ransomware and encryption. The group has claimed 238 victims to date, with recent attacks including: - Coca-Cola’s Middle Eastern bottling partner (May 2024) - South African healthcare giant Mediclinic - Australian behavioral science firm Evidn (earlier in 2024) Mailchimp has not yet publicly responded to the breach. The incident highlights the ongoing threat posed by ransomware groups targeting high-profile marketing and customer data platforms.

Vimeo Confirms Data Breach via Third-Party Analytics Provider Video hosting platform Vimeo has disclosed a data breach stemming from a compromise at a third-party analytics vendor. The incident exposed user and customer data, including technical information and email addresses, though Vimeo confirmed that core systems and sensitive credentials remained unaffected. The breach highlights the risks of third-party dependencies in cybersecurity, as attackers leveraged access through an external provider to extract data. While the full scope of the exposure is still under investigation, Vimeo has not reported any direct impact on payment details or passwords. The incident follows a pattern of recent cyberattacks targeting supply chains, where vulnerabilities in vendor systems serve as entry points for threat actors. No specific timeline for the breach was provided, but the disclosure underscores the growing threat landscape for organizations reliant on external services.