Universal Music Group admits data breach, Social Security Numbers and more stolen

Universal Music Group (UMG), the world’s largest music company, confirmed suffering a cyberattack in which sensitive customer information was stolen.

In a data breach notification letter sent to affected individuals, the company said that it detected unauthorized activity in one of its internal applications in early July 2024. Subsequent investigation determined that the threat actors exfiltrated people’s names and Social Security Numbers.

UMG also filed a form with the Office of the Maine Attorney General, in which it said that the breach affected 680 people, including one resident of Maine.

No evidence of misuse

While the breach definitely sounds limited, compared to some others we’ve seen lately, it is still big enough to result in phishing, or identity theft, which could lead to more dangerous attacks, such as ransomware. At this time, UMG does not believe this is the case:

“While we have found no evidence that your information has been misused, we are informing you of the incident to allow you to take steps to maintain the security of your identity,” the company wrote.

So, the data is yet to be abused somewhere - however, UMG is not taking any chances, and will be offering credit monitoring and identity theft protection through Experian’s IdentityWorks for 24 months, for affected people.

UMG did not share more details about the incident, so we don’t know if this was a ransomware attack in the first place. Usually, ransomware attacks do result in data theft, as well, although in recent times, some groups skip the encryption part and just go for the data. It’s faster and cheaper that way, yet apparently yields the same results.

No threat actors have assumed responsibility for the attack, as well.

Headquartered in the Netherlands, UMG is the world's largest music company, engaged in the recording, publishing, and distribution. It represents a vast catalog of artists and owns several prominent labels, such as Capitol Records, Def Jam, and Republic Records.

Via Infosecurity Magazine

More from TechRadar Pro

• 170 million strong data leak traced to US data broker
• Here's a list of the best firewall software around today
• These are the best endpoint security tools right now