Menu
MCAP $2.90T ▼-2.50%
BTC $86,043 ▲+1.43%
ETH $2,714 ▲+0.70%
BNB $791.05 ▲+0.83%
XRP $1.510 ▲+1.30%
SOL $120.40 ▼-0.24%
DOGE $0.0957 ▲+3.30%
ADA $0.268 ▲+10.22%
TRX $0.3353 ▼-0.01%
LINK $14.10 ▲+0.49%
AVAX $10.94 ▼-0.95%
HYPE $90.45 ▲+0.71%
DOT $1.220 ▲+3.59%

Data Breach

Every Crypto Coin Show story tagged Data Breach, newest first, alongside the guides and interviews that give it context.

Newsletter
The biggest vulnerability in your Bitcoin wallet might be the shipping label
Legal & Crime

Trezor breach exposes 80,689 customers to phishing through retained shipping records

, , , , , ,

BitcoinSeptember 12, 2026·3 min read

Hardware wallet manufacturers collect names and addresses essential for delivery, but these details can persist in vendor databases for years and become tools for targeted phishing attacks against Bitcoin holders. A Trezor breach affecting 80,689 customers demonstrates how shipping records, considered temporary operational data, expose users to identity-based social engineering even after devices arrive and private keys remain secure.

  • Trezor disclosed that approximately 67,000 additional US customers were affected by a ShipMonk breach, with records spanning 2019 to 2021 orders.
  • Leaked information included only contact and delivery details; no private keys, wallet contents, or funds were exposed or stolen.
  • Physical mail and personalized email using shipping data enable convincing phishing campaigns targeting wallet recovery words, bypassing device-level security.
  • 80,689 Total Trezor customers affected by shipping provider breach disclosure overall
  • 2019-2021 Years covered by affected orders in the Trezor ShipMonk incident
  • 0 Financial losses reported so far despite customer data exposure

Hardware wallet manufacturers sell security by keeping private keys isolated from internet-connected computers, yet the purchase process creates an unprotected record that outlasts the device’s usefulness. According to reporting on the incident, Trezor’s Sept. 4 update to its shipping-provider breach disclosure revealed that ShipMonk, the fulfillment vendor, retained customer contact and delivery information from orders placed years earlier. Trezor confirmed that its own systems and devices were unaffected, that parcel contents remained secure, and that no financial theft occurred. But the absence of immediate financial loss masks a persistent vulnerability: a home address tied to a Bitcoin purchase creates a permanent target for impersonation and social engineering.

Shipping records enable targeted phishing campaigns against wallet owners

A thief with a customer’s name and address can craft messages that feel legitimate in ways generic spam cannot. Ledger’s record of phishing campaigns documents instances of physical letters directing recipients to scan codes or visit fraudulent websites where they are prompted to share recovery words. An email addressed to you by name, referencing an order from years ago, carries far more credibility than a mass mailing sent to millions.

Letters delivered to your home can easily mimic official correspondence, even when their instructions are fraudulent.

The attack succeeds not by compromising the hardware wallet itself but by persuading the owner to voluntarily hand over backup recovery words, the only credential that bypasses device-level protection entirely.

A name and address alone cannot drain a wallet, but they transform a broad attack into a precision strike against someone the scammer can credibly impersonate as a business or service provider the customer once trusted.

Permanent data retention exposes customers long after purchase purposes expire

Shipping information serves a legitimate short-term function: routing parcels, resolving delivery failures, and processing returns. That temporary operational need does not justify permanent storage. The Federal Trade Commission’s business guidance establishes a straightforward principle: collect and retain sensitive information only for a legitimate business need, know where it goes, and dispose of it securely. Yet retailers and their fulfillment partners routinely retain old records in database replicas, support-system exports, and backups long after removal from active systems.

A deletion clause in a contract and a vendor’s assurance that records were removed are not the same as direct evidence that every storage system, including replicas, exports, and backups, actually applied the retention policy. Manufacturers choose the warehouse and negotiate the contract, giving them leverage to demand proof of secure disposal. Most do not.

Home addresses remain valid long after the original purchase is forgotten, and a copied record cannot be recalled from everyone who received it.

Manufacturers must demand evidence of data deletion, not accept vendor assurances

Protecting the person who buys a hardware wallet requires manufacturers to establish retention limits before a breach occurs. This means collecting less information where possible, separating data that does not need to travel together, and requiring vendors to prove that old records have been securely deleted when their operational purpose expires.

A parcel locker, neutral packaging, or a separate contact detail for online orders can reduce attack surface, but none of these measures eliminate the retailer’s own database records.

Trezor’s breach demonstrates that contract language alone is insufficient; manufacturers must implement processes to verify deletion across all systems where data is stored or replicated, establish clear retention deadlines tied to operational necessity rather than administrative convenience, and hold vendors accountable with periodic audits rather than one-time assurances. Until hardware wallet makers demand and verify evidence that shipping records are actually removed, buyers will remain exposed to targeted phishing campaigns years after their devices arrive and their private keys are secured.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

Users exposed by Trezor breach grows sixfold after supposedly deleted shipping logs are found
Legal & Crime

Users exposed by Trezor breach grows sixfold after supposedly deleted shipping logs are found

, , , , ,

BlockchainSeptember 5, 2026·5 min read

Hardware wallet maker Trezor disclosed that a breach at its logistics provider ShipMonk exposed approximately 67,000 additional U.S. customers, six times the initial count, after supposedly deleted shipping records from 2019 to 2021 remained in the vendor’s systems despite written assurances of deletion. The incident expands institutional custody and consumer protection risks in an ecosystem where hardware wallets have become central to asset security strategies, and raises questions about third-party data retention practices across the blockchain infrastructure stack.

  • Trezor’s disclosed exposure expanded from 13,689 to roughly 80,689 customers after logs deleted per policy remained at ShipMonk for years.
  • Exposed data spans November 2019 through August 2021 and includes names, emails, phone numbers, addresses and order numbers, linking individuals to hardware wallet purchases.
  • Trezor received written deletion assurances from ShipMonk multiple times, yet records persisted; the breach originated from a Metabase analytics platform zero-day vulnerability.
  • 67,000 Additional U.S. customers exposed in Sept. 4 update versus initial August disclosure
  • 80,689 Approximate total customer count exposed across both disclosure periods combined
  • 90 days Trezor’s stated data retention policy window before deletion from partner systems

On September 4, Trezor announced a significant revision to its August 13 disclosure of a security breach at ShipMonk, its third-party logistics provider. The new update revealed that approximately 67,000 additional U.S. customers had been exposed, a figure that dwarfs the originally disclosed 13,689 affected users and brings the total known exposure to roughly 80,689 people.

The breach exposed contact and order information spanning November 2019 through August 2021, including names, email addresses, phone numbers, shipping addresses and order numbers.

Critically, the newly discovered records had persisted in ShipMonk’s systems despite Trezor’s written deletion requests and the company’s stated 90-day data retention policy, which requires customer information to be purged from both Trezor and partner systems after that window expires.

Trezor received written deletion assurances that ShipMonk failed to honor for years

The breach represents a stark failure in third-party data governance. Trezor stated that it had “repeatedly requested and received written assurances” that ShipMonk had deleted historical customer records, yet the vendor retained data going back to 2019, nearly six years before the breach discovery.

Trezor’s published delivery-data policy explicitly commits to a 90-day deletion window, with limited exceptions for ongoing order fulfillment issues. The company did not disclose the dates of the assurance letters ShipMonk provided or publish the correspondence itself, leaving unclear how frequently Trezor verified compliance or what triggered the discovery that the deletions had never occurred.

The incident compounds institutional custody risks at a moment when large asset managers and financial institutions have begun integrating hardware wallets into qualified custody workflows. A breach that exposes physical addresses linked to hardware wallet purchases creates attack surface unavailable in conventional securities infrastructure.

Trezor emphasized that the breach did not compromise wallet cryptographic material, no recovery seeds, private keys or wallet funds were exposed, and that the company’s devices and systems remained secure.

The risk instead emanates from the peripheral data: the connection between an identified individual, a physical location and a confirmed hardware wallet purchase can inform convincing social engineering, fraudulent communications or physical targeting.

Trezor acknowledged that the exposed information could support scam emails, fraudulent calls or letters and potential physical targeting.

Metabase zero-day vulnerability opened ShipMonk’s systems to unauthorized access

According to BleepingComputer reporting, ShipMonk’s breach originated from an unpatched vulnerability in Metabase, an open-source analytics platform. The August zero-day flaw allowed an attacker to create a session tied to an administrator account and execute bulk table downloads without authentication.

This attack vector gave an unauthorized actor direct access to ShipMonk’s historical order database, exposing records that should have been purged years earlier under Trezor’s contractual retention policy. The vulnerability represented a known security risk in a widely deployed analytics tool, underscoring the cascade effect when third-party vendors fail to patch critical infrastructure.

The distinction between Trezor’s systems and ShipMonk’s infrastructure is crucial for institutional risk assessment. Trezor’s own systems, products and services were not compromised, and the security of devices themselves remained intact.

However, the vendor relationship created a trust assumption that proved unfounded: Trezor relied on ShipMonk’s adherence to data deletion practices, monitoring and security posture without publishing the contractual terms, audit frequencies or remediation timelines that would normally govern such arrangements.

The expanded disclosure suggests Trezor did not discover the data retention failure through its own audit but rather through ShipMonk’s post-incident investigation or external security review after the Metabase vulnerability was exploited.

The breach did not reach Trezor’s wallet systems, and devices remained secure; the risk centers on the peripheral identity and physical location data.

No confirmed downstream attacks documented, but physical targeting risks remain open

As of the September 4 update, Trezor reported no confirmed downstream attacks using the exposed dataset. This absence does not eliminate the risk: datasets linking identifiable individuals to high-value asset infrastructure typically attract targeting by organized crime, fraud rings and state-level actors.

The data’s composition, names, addresses, phone numbers and explicit hardware wallet purchase records, creates a targeting list of known asset holders, a category substantially more valuable than generic contact databases or email leaks that trade in underground forums at single-digit dollar costs per thousand records.

The institutional implications extend beyond individual customer risk. Regulated entities integrating Trezor or other hardware wallet solutions into custody infrastructure must now factor third-party logistics and data retention failures into their vendor risk assessments.

The incident demonstrates that even companies with published data policies and contractual safeguards cannot guarantee compliance from partners without rigorous verification, audit trails and financial penalties for non-compliance.

For asset managers and financial institutions currently evaluating hardware wallet custody solutions, the Trezor-ShipMonk incident provides a case study in the operational complexity and third-party dependencies that peripheral custody solutions introduce compared to fully managed, regulated custodians.

Trezor has not disclosed whether the 13,689 originally affected users and the 67,000 newly disclosed users represent entirely separate populations or whether there is overlap between the groups.

The company’s use of the phrase “another approximately 67,000” suggests it considers the new figure additional, but without published data or group analysis, institutional investors cannot determine the true scope of customer exposure or assess whether their own address data appears in either disclosure.

Trezor has not published the underlying data, the assurance letters from ShipMonk, or a clear accounting of how many total unique customers were exposed across both disclosure periods, leaving institutional counterparties unable to independently verify customer risk exposure or conduct their own impact assessments. The company’s next disclosure should include the specific dates of ShipMonk’s deletion assurances, the audit frequency Trezor employed to verify third-party compliance, and a consolidated customer count with overlap analysis to enable informed custodial decisions.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

Google ties the Uber Freight hackers to a $10.6 million vishing operation
Institutional

Google ties the Uber Freight hackers to a $10.6 million vishing operation

, , , , , ,

InstitutionalAugust 13, 2026·5 min read

Google’s threat intelligence team has connected the Helix ransomware gang, responsible for the Uber Freight breach disclosed this month, to a $10.6 million extortion operation that has systematically targeted institutional finance, logistics, and technology firms using sophisticated voice phishing tactics. The link reveals a coordinated campaign using multiple operational aliases and consistent attack methods that bypass multi-factor authentication, creating material risk for institutional investors and their service providers across multiple sectors.

  • Helix claimed to steal approximately one million files from Uber Freight mailboxes, OneDrive accounts, and accounts receivable repositories, beginning public disclosure on August 6.
  • Google traced the group to $10.6 million in ransom bitcoin collected between January and May across multiple victim organizations and operational aliases.
  • The attackers use phone-based social engineering to impersonate IT staff, directing targets to fake login pages that harvest credentials and multi-factor authentication tokens for cloud platform access.
  • $10.6M Bitcoin ransoms collected by the group from January through May across multiple victims
  • 1M Stolen files allegedly exfiltrated from Uber Freight systems and repositories
  • $17B Annual goods moved by Uber Freight, representing scale of potential operational impact

Uber Freight, the logistics subsidiary of ride-hailing company Uber and one of North America’s largest managed-transportation networks, confirmed a data security breach involving unauthorized system access in early August but disclosed no ransom demand or payment.

The company said it contained the incident without operational disruption, though the attackers’ public leak site subsequently featured approximately one million files allegedly drawn from email accounts, cloud storage repositories, accounts receivable databases, and internal dispatch systems.

Timestamps on some leaked documents clustered around mid-June, suggesting the breach may have occurred weeks before detection and public disclosure.

The incident disclosure came as Google’s Threat Intelligence Group published a report linking the Helix operation to a far broader extortion campaign operating under multiple names including UNC6671, Redact, Pink, and Falcon. The researchers traced all variants back to a single operational group that previously operated under the BlackFile banner before retiring that brand in May 2026.

This consolidation of aliases under one threat actor reveals a sophisticated organization managing parallel attack campaigns across multiple vertical markets.

Google Links Four Operational Aliases to Single $10.6 Million Ransomware Crew

Google’s attribution connects Helix directly to UNC6671 and its subsidiary operational names through consistent attack methodology and bitcoin wallet analysis spanning six months of activity.

Between January and May 2026, the researchers identified at least $10.6 million in ransom payments flowing to wallets controlled by the group, a figure substantially larger than most individual ransomware incidents and suggesting either multiple simultaneous extortions or repeat victimization across a portfolio of targets.

The crew’s ransomware-as-a-service model using multiple public personas allows operational flexibility and complicates victim coordination and law enforcement response.

The transition from manufacturing, healthcare, and insurance targeting in spring to technology, transportation, and hospitality sectors in June marks a deliberate strategic shift toward higher-value institutional targets and companies managing critical infrastructure.

This pivot aligns with the timing of the Uber Freight breach and demonstrates the group’s willingness to retarget based on victim sector profitability. The shift also suggests vulnerability in logistics and technology firms’ security posture relative to manufacturing and healthcare sectors that may have invested more heavily in ransomware defenses following prior high-profile campaigns.

Vishing Calls Impersonating IT Staff Bypass MFA by Harvesting Tokens Directly

The attack methodology relies on phone-based social engineering rather than technical exploits, with operators calling targets on personal mobile devices and impersonating IT helpdesk personnel to initiate mandatory security migrations.

Targets are directed to fraudulent login portals where adversary-in-the-middle tooling intercepts both passwords and multi-factor authentication tokens in real time, completely circumventing organizations’ MFA controls.

This approach succeeds because it exploits the authentication process itself rather than attempting to crack or bypass it, making it effective even against environments with strong credential policies.

Once tokens are harvested, attackers gain direct access to cloud environments, primarily Microsoft 365 and Okta platforms, allowing lateral movement through corporate repositories and high-value data repositories like email, file storage, and financial records.

The method’s effectiveness against institutional targets became visible in August when vishing attempts targeted major Wall Street hedge funds including Point72, Citadel, Two Sigma, and Millennium Management.

While those firms reported that client data remained secure, the targeting of multi-billion-dollar asset managers signals that the group views elite institutional finance as viable victim terrain despite presumed security sophistication.

In February 2026, blockchain lender Figure Technology publicly confirmed a breach following a social engineering attack where employees were manipulated into granting file system access, indicating the campaign targeting financial services companies extended well beyond hedge funds into fintech and crypto-adjacent institutions.

The consistency of successful attacks across disparate institutional sectors suggests either systematic gaps in employee security training or the sophistication of the attackers’ pretexting scripts.

Ransomware Rebranding May Obscure Attribution and Complicate Victim Coordination

The operational structure, where Helix, UNC6671, Redact, Pink, and Falcon represent the same underlying organization with different public personas, creates significant attribution and victim coordination challenges.

Victims of Helix breaches may not immediately recognize that their attackers operate under other names, preventing information sharing with organizations breached by Redact or Pink variants. This fragmentation also complicates law enforcement efforts to build cumulative cases against the organization and raises the threshold for regulatory action or sanctions.

The retirement of the BlackFile brand and consolidation under new aliases suggests operational adaptation in response to law enforcement scrutiny or reputation damage. Rebranding is a common tactic among ransomware operators facing decreasing victim willingness to negotiate with well-known gang names.

The cycle of alias rotation and brand retirement means that threat intelligence and attribution must continuously update to track the same underlying operator under new public-facing identities.

Institutional Targets Face Escalating Risk in Transportation and Technology Sectors

The group’s explicit sector pivot toward transportation and technology in June, combined with demonstrated success against Uber Freight and hedge funds, indicates institutional investors with exposure to logistics companies or technology firms managing distributed workforces face material risk.

The vishing methodology’s reliance on social engineering rather than technical exploits means no patch cycle or infrastructure upgrade can eliminate the attack surface. Organizations cannot simply apply security updates or architectural changes to defend against attackers who exploit human judgment.

Institutional investors evaluating portfolio companies and investment targets should assess whether logistics, fintech, and enterprise software firms have implemented layered defenses beyond standard MFA, including behavioral analytics, impossible travel detection, and mandatory callback verification protocols for IT support requests.

The $10.6 million ransom tally also raises questions about whether affected firms, particularly smaller ones without ransomware insurance, will face pressure to negotiate and pay, potentially funding further operations and targeting within the same sectors.

Google’s report was published on August 7, shortly after Uber Freight’s public disclosure, but the group remains active with ongoing targeting of institutional finance and logistics firms. Law enforcement agencies including the FBI have been engaged according to Uber Freight’s statement, though no public arrests or indictments have been announced. Institutional investors should monitor whether regulatory bodies including SEC or FINRA issue guidance on ransomware incident disclosure and whether the Department of Justice names specific sanctions targets tied to the Helix operation, as such action would directly constrain ransom payment routes and may signal enforcement escalation.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

Hackers Expose How AI Music App Suno Stole Decades Worth of Copyrighted Music
Blockchain

Hackers Expose How AI Music App Suno Stole Decades Worth of Copyrighted Music

, , , , , ,

AI NewsJuly 17, 2026·5 min read

A security breach at AI music generation startup Suno has exposed the company’s systematic harvesting of millions of copyrighted songs to train its models, raising acute questions about data governance and legal liability as the firm faces multiple copyright lawsuits. For institutional investors in AI infrastructure and music-adjacent crypto projects, the incident signals both the technical and regulatory risks inherent in large-scale machine learning training on unlicensed content.

  • Suno’s datasets contained 2,013,545 YouTube Music clips and 113,879 hours of YouTube Music alone, representing decades of copyrighted material.
  • The hack exposed source code documenting Suno’s scraping of YouTube Music, Genius, Deezer, Jamendo, Freesound, Pond5, and IMSLP without licensing agreements.
  • The breach also revealed access to sensitive user payment data via Stripe, compounding security and compliance exposure beyond copyright infringement claims.
  • 2,013,545 YouTube Music clips ingested into Suno datasets per exposed source code file
  • 113,879 hours of YouTube Music content in training data, equivalent to over 13 years of continuous audio
  • Multiple ongoing copyright lawsuits against Suno from major record labels and rights holders

A security researcher operating under the pseudonym ellie.191 obtained Suno’s source code and documented in granular detail how the AI music generation platform scraped millions of songs from public websites to build its machine learning models, according to reporting by 404 Media.

The exposed files reveal that Suno systematically harvested music and metadata from YouTube Music, Genius lyrics, Deezer, and smaller libraries including Jamendo, Freesound, Pond5, and the International Music Score Library Project, consolidating them into training datasets of staggering scale.

The hack confirms what Suno had already conceded in court filings: that it used “essentially all music files of reasonable quality that are accessible on the open internet” without negotiating licenses or securing rights holder consent.

The breach carries immediate consequences beyond copyright exposure, as the hacker also demonstrated access to Stripe payment information tied to Suno user accounts.

Suno’s Admitted Scraping Strategy Confirmed by Leaked Training Data Architecture

Suno had previously disclosed its training methodology in legal documents filed in response to copyright infringement suits, but the leaked source code provides the first technical granularity on execution scale.

One repository file labeled “youtube_music” contained metadata for more than 2 million discrete music clips, while a corresponding database record documented 113,879 hours of YouTube Music content alone, roughly 13 years of uninterrupted audio.

That single source represents only a fraction of Suno’s total training corpus, which appears to span hundreds of thousands of hours when all scraped libraries are combined.

The scale is material to institutional investors evaluating AI infrastructure ventures because it exposes the operational model underlying Suno’s product: rather than licensing music catalogs or generating synthetic training data, the company built its competitive position on unauthorized ingestion of the entire publicly accessible internet music archive.

This approach has cost advantages during development but creates asymmetric legal and reputational risk once the company seeks institutional capital or profitability.

Suno has raised venture funding at a reported valuation exceeding $500 million, yet now faces cumulative copyright claims from Universal Music Group, Sony Music, and RIAA member labels, suits that could impose damages, training data deletion orders, or injunctions against model deployment.

Hacker Access to Payment Systems Reveals Layered Data Security Gaps

Beyond the copyright exposure, the breach demonstrates that Suno’s security architecture failed to compartmentalize sensitive user data from source code repositories.

The hacker obtained access not only to training data infrastructure but also to Stripe API integration and associated payment records, suggesting insufficient access controls and possibly hardcoded credentials within the codebase itself.

This pattern mirrors earlier breaches at AI startups where rapid scaling and product-focused engineering teams deprioritize security hygiene in favor of feature velocity.

For institutional investors conducting due diligence on Suno or comparable AI music ventures, the incident raises material governance questions: Does the company employ third-party security audits or bug bounty programs? Are API credentials rotated and stored separately from application code? Does the organization maintain insurance coverage for data breach liability?

Suno has not yet disclosed whether it has notified affected users or regulators under applicable data protection rules, nor has it published a detailed incident response. The silence itself is notable, as it suggests either ongoing remediation or regulatory consultation that prevents immediate disclosure.

Suno’s Legal Response Maintains Training Defense Despite Mounting Evidence

In a statement to 404 Media, Suno reaffirmed that its “AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet,” and that the company’s “goal has always been to help people create original new music, not replicate someone else’s.” The statement is technically accurate on the sourcing claim, the files were publicly accessible, but ignores the distinction between legal access and authorized use that underpins copyright law in most jurisdictions.

Under U.S. copyright doctrine and the Digital Millennium Copyright Act, mere public availability does not confer a right to scrape, reproduce, and retrain on protected content without a license, fair use defense, or explicit opt-in consent.

The Copyright Office has indicated skepticism toward blanket fair use arguments in generative AI training, and the European Union’s AI Act requires explicit licensing for certain copyrighted training data.

Suno’s reliance on the “publicly available” framing is a legal posture, not a substantive defense, and the company’s own internal documentation now stands as evidence of willful, at-scale infringement rather than incidental use.

The company has also claimed that independent tests showing Suno’s ability to replicate published songs do not represent the model’s actual design intent, but rather edge cases or user misuse.

Yet the leaked datasets include artist-specific metadata and categorical organization, suggesting that the training process was structured to preserve artist identity and style, increasing the technical likelihood that the model could reproduce recognizable work.

Institutional Capital at Risk as Copyright Exposure Approaches Trial Threshold

The timing of the breach is significant because Suno’s copyright cases are advancing toward summary judgment or trial. Universal Music Group’s suit, filed in June 2024, names Suno and OpenAI (which invested in Suno) as co-defendants and alleges direct infringement and violations of the DMCA. Sony Music and the RIAA have brought parallel suits.

Discovery in these cases will now pit the leaked source code and training data architecture against Suno’s legal arguments, and the hacker’s documentation may be introduced as evidence of scienter, the company’s knowledge that its actions implicated copyright law.

Venture investors who backed Suno at high valuations now face dilution or loss scenarios if settlement costs or licensing requirements materially reduce the company’s financial runway or raise its cost of capital.

Institutional investors considering later-stage rounds will demand escrow for contingent liabilities and may require that Suno obtain representations and warranties insurance against copyright claims, a costly hedge that reflects market assessment of legal risk.

Suno has not announced any plan to license the music in its training datasets retroactively, nor has it stated whether it will modify its training methodology going forward. The next concrete step will be the courts’ response to discovery motions filed by Universal and Sony, likely within the next two to three months, which will determine whether Suno must produce the full technical documentation of its training process and whether the leaked source code is admissible as authentic evidence of the company’s data practices.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

claude-mythos-thumbnail
AI News

Claude Mythos: The Model That Leaked Itself

, , , , , , , , , ,

Claude Mythos: The Model That Leaked Itself | Ashton Addison
AI & Cybersecurity

Claude Mythos:
The Model That
Leaked Itself

Inside Anthropic’s accidental unveiling of Claude Mythos — the most powerful AI model ever built, held back because it might be too dangerous to release — and the market meltdown that followed.

AA
Ashton Addison March 28, 2026  ·  8 min read
EXCLUSIVE
INVESTIGATIVE
~3,000 Assets Exposed
−7% CrowdStrike Drop
−3% IGV ETF Decline
500+ Zero-Days Found by Opus 4.6
30 Orgs Breached via Claude Code

In one of the more ironic data incidents in recent AI history, Anthropic — a company whose newest model is being held back specifically because of its unprecedented cybersecurity capabilities — accidentally exposed that model to the public through a basic configuration error on its own website.

The fallout was immediate: cybersecurity stocks cratered, crypto slid, and the broader tech sector sold off. But the real story is what the leak revealed about where AI is headed — and whether the industry is ready for a model its own creator calls too dangerous to release.

01 — The LeakHow 3,000 Files Went Public Overnight

On the evening of March 26, 2026, two independent cybersecurity researchers discovered something unusual sitting in a publicly accessible corner of Anthropic’s web infrastructure. Alexandre Pauwels of the University of Cambridge and Roy Paz, Senior AI Security Researcher at LayerX Security, had stumbled into what appeared to be a fully staged product launch — headings, body copy, images, PDFs, and a publication date — all sitting unprotected in an unencrypted, publicly searchable data store.

The disclosure was not a malicious breach. Digital assets — including images, PDF files, and audio files — were set to public by default upon upload, unless explicitly marked private. A toggle switch in Anthropic’s content management system was left in the wrong position, making approximately 3,000 assets linked to Anthropic’s blog publicly accessible. In total, there appeared to be close to 3,000 assets that had not previously been published to the company’s public-facing news or research sites that were nonetheless fully visible.

⚠ Configuration Error

The leak was not a cyberattack. Anthropic attributed it to “human error” in its content management system — a default-public setting that exposed staged assets before any editorial review. The same model the documents warned could trigger AI-powered cyberattacks was revealed by a misconfigured checkbox.

Among those exposed materials: a draft blog post detailing the existence, capabilities, and extraordinary risks of Anthropic’s next-generation AI model — a system called Claude Mythos.

02 — What Is Claude Mythos?A New Tier Above Opus

Anthropic currently markets its models in three tiers: Haiku (small and fast), Sonnet (balanced), and Opus (most capable). The leaked materials introduced a fourth category, internally named Capybara — larger and more intelligent than Opus, and significantly more expensive to run.

From the Leaked Draft

“Capybara is a new name for a new tier of model: larger and more intelligent than our Opus models — which were, until now, our most powerful.”

Two versions of the draft blog post surfaced — one calling the model “Mythos,” the other “Capybara” — suggesting Anthropic was still deciding between name candidates. The subtitle of the Capybara version still read: “We have finished training a new AI model: Claude Mythos.” Both versions explained the name was chosen to evoke “the deep connective tissue that links together knowledge and ideas.”

The draft described Claude Mythos as “by far the most powerful AI model we’ve ever developed.” When Fortune contacted Anthropic for comment, the company acknowledged the project without hesitation: “We’re developing a general purpose model with meaningful advances in reasoning, coding, and cybersecurity. Given the strength of its capabilities, we’re being deliberate about how we release it. We consider this model a step change and the most capable we’ve built to date.”

4th Tier New “Capybara” model class above Opus
↑↑↑ Dramatic gains in coding, reasoning & cyber
Limited Early access: cyber defenders only
$$$ “Very expensive to serve” — no general release

03 — CybersecurityThe Dimension That Stopped the Release

If Anthropic was simply excited about Claude Mythos’s capabilities, it would have launched quietly with the usual product post. Instead, the company is holding it back. The reason, spelled out in the leaked documents, is cybersecurity — and the concern is not hypothetical.

“Currently far ahead of any other AI model in cyber capabilities… it presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders.”
— Anthropic Internal Draft Blog Post, March 2026

The core issue is what researchers call the dual-use dilemma. The model demonstrated an ability to surface previously unknown vulnerabilities in production codebases — a capability that could help defenders patch flaws just as easily as it helps attackers find and exploit them. The same model that could harden a bank’s infrastructure could be the tool that breaks into it.

⬡ Frontier Red Team Finding — February 2026

Anthropic’s own Frontier Red Team documented that Claude Opus 4.6 — already publicly available — discovered over 500 high-severity zero-day vulnerabilities in production open-source codebases. Some of these bugs had been present for decades despite expert review and millions of hours of accumulated fuzzer CPU time. One vulnerability required conceptual understanding of the LZW compression algorithm — a class of reasoning no fuzzer can replicate. That was the model before Mythos.

The already-public Opus 4.6 raised serious enough flags. Anthropic simultaneously confirmed that hacking groups, including those linked to the Chinese government, had attempted to exploit Claude in real-world cyberattacks. In one documented case, a Chinese state-sponsored group ran a coordinated campaign using Claude Code to infiltrate roughly 30 organizations — including tech companies, financial institutions, and government agencies — before the company detected it. AI handled an estimated 80–90% of the operation.

“In preparing to release Claude Capybara, we want to act with extra caution and understand the risks it poses — even beyond what we learn in our own testing. In particular, we want to understand the model’s potential near-term risks in the realm of cybersecurity — and share the results to help cyber defenders prepare.” — Anthropic Internal Document

For Mythos specifically, Anthropic’s Responsible Scaling Policy (RSP) looms large. The policy defines AI Safety Levels: ASL-3 was activated in May 2025 for models that “substantially increase the risk of catastrophic misuse.” ASL-4, not yet formally triggered, applies when AI models become “the primary source of national security risk in a major area such as cyberattacks or biological weapons.” Based on the language in the leaked drafts, Mythos may be approaching that threshold.

If Mythos truly represents a step change in cyber capabilities, patch cycles that once had days or weeks of breathing room could compress to hours. The cyber arms race, already accelerating, could become asymmetric in a new and dangerous direction — with attackers using AI to discover vulnerabilities faster than human defenders can respond.

04 — Market ImpactStocks, Crypto, and the Selloff

Within hours of Fortune’s reporting, markets reacted sharply. The concerns weren’t irrational: if an AI model can autonomously discover and exploit zero-day vulnerabilities at scale, it threatens the core value proposition of every legacy cybersecurity vendor whose defenses are built on known signatures and historical threat intelligence.

Company Ticker Drop (Mar 27) Sector
CrowdStrike CRWD −7.0% Endpoint Security
Palo Alto Networks PANW −6.0% Network Security
Zscaler ZS −4.5% Cloud Security
Okta OKTA −3.0% Identity & Access
SentinelOne S −3.0% AI-Powered Security
Fortinet FTNT −3.0% Network Security
iShares Tech-Software ETF IGV −3.0% Broad Tech
Bitcoin BTC ↓ $66K Crypto / Risk-Off

Raymond James analyst Adam Tindle outlined several risks: compression of traditional defensive advantages, higher attack complexity and cost to defend, and potential shifts in security architecture and spending. Defensive approaches based on known signatures, vulnerability databases, or prior threat intelligence telemetry could be pressured as AI enables continuous discovery of novel attack surfaces.

“We read this as having the potential to become the ultimate hacking tool — one that can elevate any ordinary hacker into a nation-state adversary.”
— Analyst Note, March 27, 2026

Paradoxically, however, not every analyst read the Mythos news as a pure negative for cybersecurity. The same analyst argued that announcements like this should continue elevating cybersecurity as a top IT priority, driving spend towards modernizing cyber defenses and away from legacy tools. If AI-powered attacks are coming, companies will need AI-powered defenses — and that is a significant market opportunity.

05 — The Deliberate RolloutDefenders Get a Head Start

Anthropic’s planned release strategy for Mythos was unlike anything the company had done before. Rather than a broad API launch, the rollout was designed to be defensive-first: early access would go exclusively to cybersecurity organizations, giving them a window to harden their systems before the model — or its inevitable imitators — reached bad actors.

Phase 1 — Now
Small cohort of early-access customers, focused on cybersecurity defense. Evaluating model behavior and risks in controlled environments.
Phase 2 — TBD
Expanded Claude API access, after efficiency improvements bring down cost. Model currently described as “very expensive to serve.”
Phase 3 — No Date Set
General release, contingent on safety evaluation outcomes and cost reduction milestones. Timeline entirely open-ended.

The irony of the situation is layered. Anthropic wanted to give cyber defenders a head start — to publish benchmarks showing Mythos’s offensive potential, allow security teams to study its techniques, and harden defenses accordingly. Instead, the existence of the model, its capabilities, and Anthropic’s own alarming internal risk assessment landed in public simultaneously, with no safety preparation, no controlled disclosure, and no ability to brief the security community in advance.

06 — The IronyThe Most Cybersecurity-Aware Leak in History

The Punchline

A company warning the world about AI-powered cyberattacks was undone by a checkbox. The model described as posing “unprecedented cybersecurity risks” was revealed through a default-public CMS configuration — not by a sophisticated nation-state, not by a zero-day exploit, but by a toggle left in the wrong position.

The tech community was quick to note the absurdity. In an enormously ironic twist, the draft blog obtained by Fortune — which was “available in an unsecured and publicly-searchable data store” — was the very document claiming the new model poses unprecedented cybersecurity risks. As one observer put it: let’s hope the new model wasn’t responsible for the security of Anthropic’s company blog.

It is a test for the company, which has received significant media attention for its Claude Code and Claude Cowork tools. The successes of those products have rattled competitors. The Mythos leak adds a different kind of pressure — one rooted not in capability rivalry but in questions about Anthropic’s own operational security posture at the exact moment it is asking the world to trust its judgment on frontier AI safety.

07 — What Comes NextIPOs, Lawsuits, and Open Questions

The Mythos story does not exist in a vacuum. Anthropic is simultaneously navigating a federal lawsuit against the Pentagon over a supply-chain risk designation rooted in its refusal to remove safety guardrails from Claude. Reports also surfaced this week that the company has been discussing a Q4 2026 IPO. The revelation that Anthropic is sitting on a model it considers potentially too dangerous for general release adds new dimensions to both of those threads.

For the Pentagon dispute, it provides ammunition to critics who argue Anthropic selectively applies its safety principles. For investors and IPO watchers, it raises questions about when and how Mythos revenue appears on a balance sheet — and whether regulators might weigh in before a general release is possible.

For the broader cybersecurity industry, the implications are structural. If Mythos — and the wave of similar models it is expected to inspire — can discover zero-day vulnerabilities faster than human analysts and patch systems can respond, the entire architecture of defensive cybersecurity shifts. Signature-based detection, historical threat intelligence, and human-speed incident response all face obsolescence. The question is whether the defenders, now armed with early access to Mythos itself, can adapt faster than the attackers who will inevitably get access to similar capabilities.

⬡ The Core Risk Equation

Anthropic’s own framing: give cyber defenders a head start with Mythos → they harden systems → when similar models reach bad actors, defenses are already stronger. The flaw in that plan: the deliberate head start was eliminated the moment the leak happened. Defenders and the public now know simultaneously.

For now, Mythos remains behind closed doors — tested quietly, released carefully, and very much on the world’s radar after a week nobody at Anthropic planned for. The name was chosen to evoke the deep connective tissue that links knowledge and ideas. Instead, it became the story of how a single misconfigured setting linked a company’s most sensitive secrets to anyone with a search engine.

Primary Sources
Fortune (Bea Nolan) · Investing.com · CoinDesk
Security Boulevard · The Decoder · Techzine Global
Awesome Agents · NeuralTrust · Raymond James Research
Published
March 28, 2026
Updated: 12:00 PM CT