Vevo announces investigation after YouTube accounts for Rihanna, Justin Beiber, Taylor Swift, Kanye and more hacked

Multinational video hosting service Vevo said it will be investigating a recent incident where someone took over the YouTube pages for several high-profile artists and either uploaded music videos or changed the names of popular videos.

“Some videos were directly uploaded to a small number of Vevo artist channels earlier today by an unauthorized source. All of those improperly uploaded videos have since been deleted by Vevo. No pre-existing content was accessible to the source,” a Vevo spokesperson told The Record. 

“While the artist channels have been secured and the incident has been resolved, as a best practice Vevo will be conducting a review of our security systems.”

Vevo did not respond to questions about how someone was able to take over multiple accounts from different artists. The company is best known for providing music videos to YouTube for some of the world’s biggest artists. 

But earlier this week, several YouTube users took to Twitter to say they were getting alerts from their favorite artists about new videos. When opened, the videos were of other artists, including a popular gamer and musician going by the name IShowSpeed.

Here are my notifications of the spam video on the official youtube channel of Justin Bieber, Taylor Swift, and Harry Styles, and I know there are a lot more accounts that got hacked.
That's crazy, how someone can destroy your several year's hard work within a minute!@YouTube pic.twitter.com/W7FIhwH9jY

— Kapil "ia" (@karntheai) April 5, 2022

Some of the videos’ titles even included “hacked by @LOSPELAOSBRO.”

The pages hacked included those owned by Kanye West, Justin Bieber, Drake, Eminem, Michael Jackson, Taylor Swift, Ariana Grande, Harry Styles, Travis Scott, The Weeknd and Lil Nas X.

The affected channels have hundreds of millions of subscribers. Representatives for all of the artists did not respond to requests for comment. A spokesperson for Universal Music Group, which represents several of the artists affected, directed The Record to Vevo for comment. 

YouTube parent company Google and IShowSpeed, the artist who had some of his music posted to the hacked YouTube pages, also did not respond to requests for comment. 

‘Free Paco Sanz’

The Twitter handle “@LOSPELAOSBRO” has tweeted profusely since the attacks began on April 5. The handle’s biography section says, “Official account of the criminal group Los Pelaos.”

The group’s first tweet says they “hacked Travis Scott” and several of their subsequent tweets reference Paco Sanz, a man from Spain who is in prison for pretending to have a terminal illness in 2017. 

According to Business Insider, the security guard became famous in Spain after several musicians donated to his treatment, and private investigators subsequently exposed him as a fraud. 

He was sentenced to two years in prison after stealing more than €350,000, according to El Mundo.  

“We will not stop until the political prisoner Paco Sanz is released,” the group said in one Tweet. 

The videos uploaded to the pages of Justin Beiber, Travis Scott, Juice Wrld, Kanye West, Drake and others were titled “Justin bieber – Free Paco Sanz (ft. Will Smith, Chris Rock, Skinny flex & Los Pelaos).”

The group began to ask Twitter users for suggestions on who to hack next, eventually taking over the pages for artists like Playboi Carti, Lil Nas X, Daddy Yankee and others. The videos uploaded to those accounts included titles like “HACKED BY @LOSPELAOSBRO” or "No Doubt - no me retiro era broma @lospelaosbro."

The group proceeded to tweet out its subsequent hacks, which ranged from Cardi B to Rihanna and J Balvin. From there, the group said it was “going big,” moving to targets like Ariana Grande, Migos and others. 

Several other charged claims were tweeted out by the group. They threatened to attack more YouTube accounts but tweeted, “We do not attack governments, only private companies.”

All of the videos have been deleted but the Twitter account currently has more than 15,000 followers. 

In October, Google’s Threat Analysis Group said it disrupted several financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.

Vevo has become a popular service for artists but noted on its website that it does not provide access directly to artists, instead giving control of pages to “Content Providers” or music labels.