Loading story…
Hacktivists operating under the name "Anna's Archive" scraped Spotify's music library and published the platform's metadata online. The group claimed to have collected 256 million rows of track records and 86 million audio files, amounting to approximately 300 terabytes of metadata, though only metadata—not actual music files—has been released as of December 21. Anna's Archive, which typically focuses on archiving books and academic papers, described this action as part of a broader mission to preserve cultural knowledge, positioning the Spotify data scrape as an effort to build a comprehensive music archive.
Spotify has not reported the release of any actual audio files, and the hacktivists have stated that their intent is preservation rather than piracy. The incident highlights the ongoing risks of large-scale data scraping and the exposure of proprietary metadata, which could have implications for intellectual property and user privacy. An investigation into the unauthorized access is reportedly underway, but no further details about Spotify's response or potential impact on users have been disclosed.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
A major data leak involving Buenos Aires-based data broker SudamericaData exposed sensitive information belonging to millions of people in Argentina.
Nissan reported a third-party data breach stemming from Red Hat's compromised GitLab instance that exposed customer information. The company said financial data was not affected.
Hacktivist group Anna's Archive scraped and published Spotify metadata, exposing 256 million track records and metadata for 86 million audio files. No music files themselves were released.
Ukrainian national Artem Stryzhak pleaded guilty to participating in the Nefilim ransomware campaign, while the group's alleged leader remained at large.
The U.S. Department of Justice indicted 54 members of the Tren de Aragua gang over alleged ATM jackpotting attacks using Ploutus malware.
Authorities in Nigeria arrested the suspected operator of the RaccoonO365 phishing service, which was used to target Microsoft 365 accounts globally.
Interpol coordinated Operation Sentinel against cybercrime in Africa, resulting in 574 arrests and the seizure of $3 million in illicit funds tied to schemes including business email compromise and ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A pirate archivist group known as Anna's Archive has allegedly scraped and downloaded a significant portion of Spotify's music library, amounting to approximately 300 terabytes of data. This collection includes around 86 million audio files, which represents about 37% of Spotify's total music catalog but covers nearly all of the platform's most-listened tracks. The group also accessed 256 million rows of metadata, and both the music files and metadata have been distributed via torrent sites, raising major concerns about copyright infringement and data security. Spotify has acknowledged the incident and confirmed that a third party used illicit tactics to circumvent digital rights management (DRM) protections and scrape both public metadata and some audio files. The company is actively investigating the breach, which has drawn attention due to the scale of the data involved and the public availability of the metadata through Anna’s Archive. The incident highlights ongoing challenges in protecting digital content from large-scale unauthorized access and distribution, especially by groups motivated by preservation or hacktivist ideologies.
Jun 29, 2026
SoundCloud confirmed unauthorized access to an internal/ancillary service dashboard that enabled attackers to correlate **hidden email addresses** with information already visible on public SoundCloud profiles, impacting roughly **29.8 million accounts** (about **20%** of its user base). Exposed data was primarily **email addresses** plus public-profile metadata (e.g., usernames/display names, avatars, follower/following counts, and other profile statistics); SoundCloud stated **no passwords or financial data** were accessed. Users also reported service disruptions around the time of the incident, including access issues such as `403 Forbidden` errors (notably when connecting via VPN), consistent with post-incident security changes and response actions. Reporting attributed the intrusion and subsequent extortion attempt to the **ShinyHunters** group, with SoundCloud later acknowledging the actor made demands and used harassment tactics such as **email flooding**. The stolen dataset was subsequently leaked and then added to *Have I Been Pwned* for exposure checking, increasing downstream risk of targeted phishing and account-takeover attempts via credential stuffing on other services where users may have reused emails as identifiers. Separate contemporaneous claims by ShinyHunters against other companies (e.g., Panera Bread, CarMax, Edmunds) were reported but are distinct from the confirmed SoundCloud incident and include different alleged access vectors (e.g., stolen SSO codes).
Jun 29, 2026
AI music generator **Suno** was breached after a supply-chain compromise reportedly infected an employee with the **Shai-Hulud** worm, giving an attacker access to source code, customer records, and Stripe-related payment data. Reports said the exposed customer information included email addresses, phone numbers, and partial credit card details, while Suno described the November 2025 incident as limited and quickly contained. The company also reportedly did not notify affected customers, and said the leaked code was largely outdated and that full card numbers are not stored in Stripe. Leaked source code allegedly showed Suno collected training audio and metadata from a wide range of services, including **YouTube Music**, Deezer, Genius, Pond5, Jamendo, Freesound, IMSLP, stock music libraries, and podcast feeds indexed through PodcastIndex. The breach was tied to the broader **Shai-Hulud** campaign, a worm that steals GitHub and cloud credentials from developer environments and can expose them through public GitHub repositories after spreading via malicious package republication across ecosystems such as npm, PyPI, and Packagist.
Jul 24, 2026