Loading story…
A pirate archivist group known as Anna's Archive has allegedly scraped and downloaded a significant portion of Spotify's music library, amounting to approximately 300 terabytes of data. This collection includes around 86 million audio files, which represents about 37% of Spotify's total music catalog but covers nearly all of the platform's most-listened tracks. The group also accessed 256 million rows of metadata, and both the music files and metadata have been distributed via torrent sites, raising major concerns about copyright infringement and data security.
Spotify has acknowledged the incident and confirmed that a third party used illicit tactics to circumvent digital rights management (DRM) protections and scrape both public metadata and some audio files. The company is actively investigating the breach, which has drawn attention due to the scale of the data involved and the public availability of the metadata through Anna’s Archive. The incident highlights ongoing challenges in protecting digital content from large-scale unauthorized access and distribution, especially by groups motivated by preservation or hacktivist ideologies.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
In response to the scraping operation, Spotify said it disabled the accounts used in the activity, implemented new safeguards, and continued monitoring for suspicious behavior. It also said it was working with partners to protect artists and deter further distribution.
Spotify acknowledged that a third party scraped public metadata and accessed some audio files by circumventing DRM, while stating that no user data or business systems were compromised. The company said it was actively investigating the incident.
The group announced and began distributing the scraped Spotify dataset through bulk torrents and staged BitTorrent releases. Public reporting said metadata was already available, while audio files were being released in phases with popular tracks prioritized.
Anna's Archive said it used large-scale scraping of Spotify metadata and circumvention of DRM protections to collect about 256 million rows of metadata and roughly 86 million audio files, totaling around 300 TB. The archive said the collection was intended as an open music preservation project and that the audio set covered the most-listened portions of Spotify's catalog.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
10 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcemalwarebytes.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourcetomshardware.com
Open sourcetherecord.media
Open sourcetechxplore.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hacktivists operating under the name "Anna's Archive" scraped Spotify's music library and published the platform's metadata online. The group claimed to have collected 256 million rows of track records and 86 million audio files, amounting to approximately 300 terabytes of metadata, though only metadata—not actual music files—has been released as of December 21. Anna's Archive, which typically focuses on archiving books and academic papers, described this action as part of a broader mission to preserve cultural knowledge, positioning the Spotify data scrape as an effort to build a comprehensive music archive. Spotify has not reported the release of any actual audio files, and the hacktivists have stated that their intent is preservation rather than piracy. The incident highlights the ongoing risks of large-scale data scraping and the exposure of proprietary metadata, which could have implications for intellectual property and user privacy. An investigation into the unauthorized access is reportedly underway, but no further details about Spotify's response or potential impact on users have been disclosed.
Jun 29, 2026
SoundCloud confirmed unauthorized access to an internal/ancillary service dashboard that enabled attackers to correlate **hidden email addresses** with information already visible on public SoundCloud profiles, impacting roughly **29.8 million accounts** (about **20%** of its user base). Exposed data was primarily **email addresses** plus public-profile metadata (e.g., usernames/display names, avatars, follower/following counts, and other profile statistics); SoundCloud stated **no passwords or financial data** were accessed. Users also reported service disruptions around the time of the incident, including access issues such as `403 Forbidden` errors (notably when connecting via VPN), consistent with post-incident security changes and response actions. Reporting attributed the intrusion and subsequent extortion attempt to the **ShinyHunters** group, with SoundCloud later acknowledging the actor made demands and used harassment tactics such as **email flooding**. The stolen dataset was subsequently leaked and then added to *Have I Been Pwned* for exposure checking, increasing downstream risk of targeted phishing and account-takeover attempts via credential stuffing on other services where users may have reused emails as identifiers. Separate contemporaneous claims by ShinyHunters against other companies (e.g., Panera Bread, CarMax, Edmunds) were reported but are distinct from the confirmed SoundCloud incident and include different alleged access vectors (e.g., stolen SSO codes).
Jun 29, 2026
AI music generator **Suno** was breached after a supply-chain compromise reportedly infected an employee with the **Shai-Hulud** worm, giving an attacker access to source code, customer records, and Stripe-related payment data. Reports said the exposed customer information included email addresses, phone numbers, and partial credit card details, while Suno described the November 2025 incident as limited and quickly contained. The company also reportedly did not notify affected customers, and said the leaked code was largely outdated and that full card numbers are not stored in Stripe. Leaked source code allegedly showed Suno collected training audio and metadata from a wide range of services, including **YouTube Music**, Deezer, Genius, Pond5, Jamendo, Freesound, IMSLP, stock music libraries, and podcast feeds indexed through PodcastIndex. The breach was tied to the broader **Shai-Hulud** campaign, a worm that steals GitHub and cloud credentials from developer environments and can expose them through public GitHub repositories after spreading via malicious package republication across ecosystems such as npm, PyPI, and Packagist.
Jul 24, 2026