Animoto 2018 Data Breach
Company · Online video creation and editing tools · Cloud-based video creation platform · USA
Animoto Cloud Video Creation Platform Breach (2018): 22 Million User Accounts Including Passwords & DOB Exposed
Cloud-based video creation service.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
34/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
25.4MRecords
2018Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
Animoto, a cloud-based video creation platform used by millions of consumers and small businesses, suffered a data breach in July 2018 due to a misconfiguration that exposed approximately 25 million user records. The breach was discovered to have resulted in stolen data being placed for sale on dark web markets. No external attacker group has been publicly attributed. The exposed data included email addresses, full names, dates of birth, geographic locations, and salted password hashes. That combination is particularly sensitive: dates of birth paired with passwords increase the risk of account takeover, and the profile is detailed enough to support targeted phishing or impersonation attacks against affected individuals and their businesses. Animoto notified affected users and forced password resets following the breach. No class-action settlement or regulatory enforcement action has been publicly documented in connection with this incident. Affected users who reused their Animoto password on other accounts remain at risk of credential-based attacks and should treat any account sharing that password as compromised.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
25.4M records analyzed
About Animoto
Animoto is a cloud-based video creation service that allows users to produce slideshow-style videos from photos, video clips, and music. The platform serves both consumers and businesses and is used for social media content, marketing, and personal projects. It operates on a subscription model with free and paid tiers and has been used by millions of individuals and small businesses globally.
Why They Hold Your Data
Cloud-based creative platforms collect user accounts, emails, passwords, payment-adjacent data, and project-related records tied to video creation and publishing workflows.
Recent Developments
Animoto continues to operate as a video creation platform. The company has faced increasing competition from video creation tools embedded in social media platforms and broader design tools. No major organizational changes have been prominently reported in the recent period.
Data Points Exposed
5 verified field types
Date of Birth High
Email Address
Full Name
Geographic location
Password High
Breach Impact
In July 2018 Animoto suffered a breach exposing approximately 25 million user records including email addresses, names, dates of birth, geographic locations, and salted password hashes. The data was subsequently placed for sale on dark web markets. Animoto notified affected users and initiated password resets. No class-action settlement or regulatory action specific to this breach has been prominently documented in public sources.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Identity verification bypass using name + date of birth combination | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation