Cyber Threat Actor: ellie.191

ellie.191 is the alias associated with a threat actor responsible for a security incident affecting Suno that was disclosed on 2025‑11‑01. The actor gained initial access through a supply‑chain worm that compromised an employee device, which subsequently allowed the theft of credentials used to enter the company’s source code repositories and customer databases. This intrusion resulted in the exposure of personal information belonging to approximately 55.3 million users, including email addresses, phone numbers, physical addresses, and Stripe purchase records containing partial card details. In addition to the data leak, the compromised source code revealed that Suno had been scraping music from platforms such as YouTube Music, Deezer, and Genius. The company did not notify affected users until the breach was reported publicly months later, a delay that contributed to a class action lawsuit alleging inadequate security and untimely disclosure. The exposed data also served as evidence in ongoing copyright litigation involving major record labels.

The observed tactics, techniques, and procedures for ellie.191 include the use of a supply‑chain worm as an initial access vector, followed by credential harvesting to achieve unauthorized access to internal repositories and databases. No specific malware families, tooling suites, or additional intrusion tools are referenced in the publicly available reporting. Attribution to any state sponsor, criminal consortium, or other affiliations has not been established in the sources provided, and therefore such details are omitted from this profile. The Suno breach remains the sole publicly documented operation linked to ellie.191, and no further campaigns or activities are described in the material at hand. No speculation about the actor’s motives, size, sophistication, geographic focus, or financial objectives is included, as those elements are not supported by the given information.