ellie.191
Attribution profile
- Type
- Criminal
- Location
- -
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2025-11-01
- Last seen
- 2025-11-01
- Updated
- 2026-11-12 00:16
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Threat actor ellie.191 is linked to a security incident at Suno in November 2025 that exposed the personal information of approximately 55.3 million users. The actor employed a supply-chain worm to compromise an employee device, obtaining credentials that provided access to source code repositories and customer databases. The breach revealed extensive user data, including email addresses, phone numbers, physical addresses, and Stripe purchase records containing partial card details, as well as source code showing the scraping of music from platforms like YouTube Music, Deezer, and Genius. The incident resulted in a class action lawsuit alleging inadequate security and delayed notification, while also providing evidence for ongoing copyright litigation with major record labels.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.