Another day, another multinational video service brought to its knees by a group of rogue hackers with a bone to pick.
Screenshot: OurMine
Vevo, the joint venture between Universal Music Group, Sony Music Entertainment, Abu Dhabi Media, Warner Music Group, and Alphabet Inc. (Google’s parent company), was just hacked. Roughly 3.12TB worth of internal files have been posted online, and a couple of the documents reviewed by Gizmodo appear quite sensitive.
The OurMine hacker squad has taken responsibility for the breach. It’s a group fairly well known: They hijacked WikiLeaks’ DNS last month shortly after they took over HBO‘s Twitter account; last year, they took over Mark Zuckerberg‘s Twitter and Pinterest accounts; and they hit both BuzzFeed and TechCrunch not long after that.
The leaked files contain a wide variety of office documents, videos, and other promotional materials. A majority of the files, from our cursory review, seemed rather mild — weekly music charts, pre-planned social media content, and various details about the artists under the record companies’ management.
But not all of the material was quite so benign. Vevo’s UK office will probably want to get this alarm code changed as soon as possible.
OurMine typically hacks people because, well, it can. The group’s primary goal apparently is to demonstrate to companies that they have weak security. In this case, the hackers managed to compromise an employee account for Okta, the single sign-on workplace app. Usually they don’t resort to leaking large caches of files — at least to our knowledge — but in this case it sounds like someone may have pissed them off.
In a post late Thursday, OurMine claimed it leaked Vevo’s files after reaching out to one of the company’s employees this week and being told to “fuck off.” But they informed Gizmodo by email: “If they asked us to remove the files then we will.”
Of course, Sony (one of Vevo’s joint owners) fell victim to a devastating hack in 2014 after a group of hackers calling themselves the “Guardians of Peace” dumped a wealth of its confidential data online. US intelligence agencies pinned the breach on North Korea (one of the hacking group’s demands was that Sony pull The Interview, Seth Rogan’s comedy about a plot to assassinate Kim Jong-Un.)
According to Business Insider, Vevo locked up nearly $US200 ($250) million in year long ad commitments this year, thanks to artists like Beyonce, Taylor Swift, and Ariana Grande helping generate some 25 million daily views. They might consider spending some of those earnings on beefing up their security. This could’ve been a lot worse.
We’ve reached out to Vevo, Sony, Warner, Universal, and Google for comment. We’ll update if we hear anything back.