Universal Music Group discloses breach affecting personal data

Multinational music corporation Universal Music Group (UMG) experienced a data breach in early July, which resulted in the exfiltration of some its data.

According to a filing with the Maine Attorney General’s Office, UMG detected unauthorized activity in one of its internal applications and promptly engaged with experts to investigate and assist with remediation. The breach occurred on July 15th, 2024.

“We determined that an unauthorized third party acquired data that potentially contained personal information. We then engaged a data-review firm to review the exfiltrated data. We received those results on August 30th, 2024, and worked with counsel to determine which individuals to notify,” UMG’s notice of data breach reads.

The breach affected the data of 680 US residents. The threat actor accessed personal information, including name and Social Security number. UMG did not find any evidence if the leaked personal information had been misused.

To the affected individuals, UMG offers a complimentary 24-month membership to Experian IdentityWorks, a credit monitoring and identity theft protection service.

The filing does not indicate whether any sensitive company information or systems were affected by the breach. No ransomware gang or other threat actor tracked by Cybernews has claimed the hack on the dark web.

Universal Music Group is a Dutch-American multinational music corporation. Along with Sony Music Group and Warner Music Group, it is one of the “Big Three” record labels. UMG’s American operational headquarters are located in Santa Monica, California. The company's catalog includes over three million recordings and four million compositions.

Cybernews has reached out to UMG for additional information and will update the story with the response.