Despacito video deleted from YouTube by hackers: How the site's most popular song ever disappeared

The hack appears to have affected many of the world's biggest artists – and isn't the first carried out by the group

Andrew Griffin
Tuesday 10 April 2018 11:02 BST
Comments
Súbeme la radio: How audiences are adapting to non-English language music

Your support helps us to tell the story

From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.

At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.

The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.

Your support makes all the difference.

Despacito, the most popular YouTube video ever, has disappeared from the site. But that's just the beginning.

A widespread hack appears to have spread across many different Vevo sites. And it doesn't appear to be the first attack by the group, who also took down Twitter accounts run by news organisations last week.

The cyber attack began when the names of many of the world's most popular music videos on YouTube appeared to have their names changed. Instead of the name of the song, the video's titles had the words "Hacked by Prosox & Kuroi'sh" written on them instead.

They also posted "Free Palestine" under the videos.

Some of them also had their thumbnails changed. The image for Despacito, for instance, showed a group of men in masks holding guns up to the camera – which doesn't happen in the video.

Soon after that, Despacito – which has been watched more than five billion times, and is the site's most popular video ever – disappeared. It's not clear whether that was the work of the hackers or someone else, such as YouTube or Vevo.

Hackers appear to have gained access to many of the channels run by Vevo: the cyber attack affected not only the Luis Fonsi video, but also songs by Taylor Swift, Shakira, Selena Gomez, Drake and more. That would suggest that the hack hit either YouTube itself or Vevo, which runs the channels, rather than the artists themselves.

A Twitter account that appears to belong to one of the hackers appeared to claim credit for the hack. It appeared to suggest that the hackers may have found a specific way of changing the names of videos – though it's still not clear whether the changes were the result of the hackers taking control of Vevo accounts or simply finding a vulnerability in them.

"It's just for fun, I just use [the] script 'youtube-change-title-video' and I write 'hacked'," the account wrote. "Don't judge me I love YouTube."

If that is true, it would suggest that the hackers only found a way to change the names and potentially thumbnails of videos, rather than delete them. That could mean that the Despacito video was deleted or hidden by someone else, potentially as a way of limiting the reach of the hack.

If that is the case, the video may just have been hidden and the record five billion views might not have been lost. Even if hackers did delete the video, it's almost certain that YouTube will be able to restore it with all of those views intact.

This isn't the first high-profile attack by the hackers involved. Last week, someone also identifying themselves as Kuroi'sh hacked into Twitter accounts run by news organisations, including NowThis – the accounts posted out a whole range of posts, many of which included Kuroi'sh's name and claimed credit for the hack.

Representatives for YouTube, Vevo and Luis Fonsi have all been contacted by The Independent.

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies

Comments

Thank you for registering

Please refresh the page or navigate to another page on the site to be automatically logged inPlease refresh your browser to be logged in