Breach Roundup: Spotify Metadata Dumped Online

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, hackers scraped Spotify metadata, Nissan disclosed a third-party breach, millions of Argentines were exposed in a data broker leak, African authorities carried out a sweeping cybercrime crackdown, Nigerian police arrested the operator behind RaccoonO365, the U.S. DOJ charged an ATM jackpotting ring and a Nefilim ransomware affiliate pleaded guilty.

See Also: Top 10 Technical Predictions for 2025

A pirate activist group going by “Anna’s Archive” scraped Spotify’s music library, posting the popular streaming platform’s metadata online.

Hacktivists in a blog post said the data scrape included 256 million rows of track records and 86 million audio files, or about 300 terabytes of metadata. As of Dec. 21, the group has published only metadata and no music files.

“Of course Spotify doesn’t have all the music in the world, but it’s a great start,” said Anna’s Archive. The group, launch in November 2022, typically focuses on books or academic papers as part of a putative mission of “preserving humanity’s knowledge and culture.” It described the Spotify scrape as an effort to build a “music archive primarily aimed at preservation.”

“An investigation into unauthorized access identified that a third party scraped public metadata and used illicit tactics to circumvent DRM to access some of the platform’s audio files,” said a Spotify representative following the incident. Investigations into the incident are still underway.

Ed Newton-Rex, a composer and campaigner for protecting artists’ copyright, told The Guardian that the leaked music files would probably be used for developing AI models. “Training on pirated material is sadly common in the AI industry, so this stolen music is almost certain to end up training AI model,” he said. Social media giant famously used an 82 terabyte file of pirated books as training data.

Japanese car manufacturer Nissan said that a third-party data breach at Red Hat affected tens of thousands of its customers.

The company said the breach stems from an incident in late September in which threat actors gained unauthorized access to Red Hat’s GitLab instance, containing example code snippets, internal communications and project specifications. Red Hat disclosed the breach in early October, stating hackers stole hundreds of gigabytes worth of sensitive data from 28,000 different GitLab repositories. Cyber extortion group Crimson Collective claimed responsibility for the September breach.

According to Nissan, customer information present in Red Hat’s GitLab repositories included names, addresses, phone numbers, partial email addresses and information connected to sales activities. No credit card or financial data was stored in the compromised repository, Nissan said.

This marks the second major security incident for Nissan this year. The first occurred in late August when the ransomware group Qilin hit the manufacturers design subsidiary Creative Box.

A massive cache of personal data allegedly linked to Buenos Aires-based data broker SudamericaData is available for download on a criminal forum in what may be one of the largest data leaks ever in Argentina. The dataset exceeds one terabyte.

SudamericaData, known for selling detailed reports on individuals and businesses, allegedly continued operations under the name “WorkManagement” after a court-ordered shutdown in 2023. The threat actor behind the release framed the disclosure as an exposure of the company’s owner and internal operations. The firm reportedly was caught up in a 2023 scandal involving illegal spying on judges.

The files circulating online reportedly include databases tied to millions of Argentines with records such as a non-public database of citizens, vehicle ownership, and work history and salary, as well as phone numbers, email addresses and physical addresses. The dataset also reportedly includes website source code and internal application files linked to the company’s infrastructure.

Police across Africa arrested 574 suspects and seized roughly $3 million in illicit funds as part of a cybercrime operation coordinated by Interpol.

The month-long effort, dubbed Operation Sentinel, ran from late October through November and involved police forces in 19 countries. Investigators targeted business email compromise, ransomware and digital extortion schemes.

Authorities identified cases linked to more than $21 million in attempted or realized losses. The operation led to the takedown of thousands of malicious links and multiple ransomware strains, several of which were successfully decrypted, allowing victims to recover data without paying ransom.

The crackdown comes amid a broader surge in cybercrime across the continent. Recent law enforcement assessments show cybercrime now accounts for more than 30% of all reported crime in parts of western and eastern Africa, with two-thirds of surveyed countries saying digital crimes make up a “medium-to-high” share of criminality in their jurisdiction. Online scams, phishing, ransomware and business email compromise dominate reported incidents across multiple regions.

Nigeria Police Force’s National Cybercrime Centre arrested Okitipi Samuel, also known as “RaccoonO365” and “Moses Felix,” identifying him as the alleged developer behind a phishing operation used to compromise Microsoft 365 email accounts globally.

Police said Samuel built and operated RaccoonO365, a phishing-as-a-service platform which generated fake Microsoft login pages to harvest credentials from corporate, financial and educational organizations. The service operated on a subscription model, offering ready-made phishing templates and infrastructure for a fee.

Between January and September 2025, attackers used phishing emails mimicking Microsoft authentication prompts to gain unauthorized access to enterprise email systems, leading to business email compromise, data theft and financial losses across multiple jurisdictions (see: Breach Roundup: Microsoft, Cloudflare Dismantle RaccoonO365).

Nigerian police said Samuel sold phishing links on a Telegram channel in exchange for cryptocurrency and hosted fake login portals on Cloudflare using stolen or fraudulently obtained credentials. The actors used CAPTCHA and anti-bot controls to evade automated detection.

Two additional suspects were arrested during coordinated operations in Lagos and Edo states, where police seized laptops and mobile devices linked to the campaign. Authorities said there is no evidence connecting the two individuals to the development or operation of the phishing platform.

U.S. federal prosecutors indicted 54 alleged members and leaders of the Venezuelan gang Tren de Aragua for their role in a multi-million-dollar ATM jackpotting scam that used Ploutus malware, the U.S. Department of Justice said.

A Nebraska grand jury charged the defendants with bank fraud, bank burglary, computer fraud, money laundering and conspiracy to provide material support to terrorists. Prosecutors allege the group infected ATMs with Ploutus, forcing the machines to dispense cash without the use of cards or customer credentials.

Ploutus is a family of ATM-jackpotting malware first identified in Mexico more than a decade ago and that has evolved into multiple variants, including Ploutus-D. Multiple variants written in Microsoft .NET allow attackers with physical access to an ATM to directly interact with the cash dispenser through industry-standard XFS middleware, bypassing bank authorization controls, according to security researchers at CrowdStrike.

Threat actors targeted ATMs across multiple states, allegedly generating millions of dollars in illicit proceeds.

The U.S. Treasury Office of Foreign Assets Control in July sanctioned top leaders of Tren de Aragua, including head Hector “Niño Guerrero” Rusthenford Guerrero Flores and five key affiliates, labeling the group a “Foreign Terrorist Organization” for its role in drug trafficking, human smuggling, extortion, sexual exploitation and money laundering across the Western Hemisphere.

A Ukrainian national, Artem Stryzhak, 35, pleaded guilty in a Brooklyn federal court to conspiracy to commit computer fraud for his role in a sprawling Nefilim ransomware campaign that targeted corporations in the United States and abroad.

Stryzhak admitted to conspiring to commit computer fraud by deploying Nefilim ransomware against corporate networks and demanding ransom payments, U.S. Department of Justice said Friday.

Also spelled “Nephilim,” the group emerged in March 2020. Although apparently inactive, Nefilim cut a high profile earlier this decade, attacking home appliances giant Whirlpool and hitting unpatched Citrix gateways.

Prosecutors said Stryzhak operated as an affiliate, using ransomware infrastructure provided by the group’s administrators in exchange for a share of the proceeds. Stryzhak was arrested in Spain in 2024 and extradited to the U.S. earlier this year.

U.S. authorities say the ransomware operation was overseen by Volodymyr Viktorovych Tymoshchuk, who remains at large. Tymoshchuk is on the FBI and Europol’s most wanted fugitive list for his alleged role in operating the Nefilim, LockerGoga and MegaCortex ransomware strains linked to hundreds of attacks worldwide (see: US Feds Indict LockerGoga and MegaCortex Ransomware Hacker).

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey.