Anodot: stolen analytics-vendor tokens used to pull data from customers’ Snowflake environments (Rockstar Games, Vimeo and others)

What happened

• Rockstar Games confirmed “a limited amount of non-material company information was accessed” and said “This incident has no impact on our organization or our players” (13 Apr). Vimeo said an unauthorized actor accessed “certain Vimeo user and customer data” through the Anodot breach: mainly technical data, video titles and metadata, and some customer email addresses; no video content, logins or card data (28 Apr). Later coverage puts Vimeo’s count at about 119,000 users and customers. ShinyHunters also lists Zara among Anodot victims.
• Root cause as reported: ShinyHunters claims it obtained authentication tokens for Anodot, a cloud cost and analytics service, giving access to cloud data environments (mainly Snowflake) of more than a dozen Anodot customers without breaching those customers or Snowflake directly. Anodot did not comment.
• ShinyHunters claimed the attacks and set leak deadlines.
• Vimeo disabled all Anodot credentials, removed the integration, engaged experts and notified law enforcement.

Sources

• https://therecord.media/rockstar-hackers-cyberattack-cloud
• https://therecord.media/vimeo-blames-security-incident-on-anodot-breach
• https://www.cpomagazine.com/cyber-security/vimeo-confirms-data-breach-impacting-119000-users-and-customers/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.