When more than a dozen of music's biggest names lose control of their official pages within hours, the problem is not a prank. It's infrastructure.
On July 26, 2026, fans noticed that Kendrick Lamar's Not Like Us had appeared on Drake's official YouTube account. The video featured the song's original cover art, an aerial view of the Toronto rapper's mansion pinned with sex-offender markers, and included a caption promoting the Instagram handle @payphobia. By morning, the attack had revealed itself as part of a mass breach hitting major artists across YouTube and Apple Music on July 26 and 27.
Leaked songs, unreleased albums and promotional posts directing viewers to Discord servers appeared on official pages belonging to Playboi Carti, Ye, Kendrick Lamar, Frank Ocean, Michael Jackson, d4vd, Ken Carson and several others. Ye's page received a single titled HH alongside a video called Mama's Boyfriend carrying unrelated audio. Carti's channel reportedly got an entire unreleased album plus more than 20 leaked tracks. Lamar's page received two tracks, Prayer and I'm Better, paired with a Discord plug.
Two unauthorized tracks landed on Drake's verified page: Lamar's Grammy-winning diss track and a fake troll upload titled Kendrick a Meanie (Diss), running just one minute and 47 seconds. The irony needs no explanation. A federal judge dismissed Drake's defamation lawsuit against Universal Music Group over Not Like Us in October 2025, and the rapper appealed that ruling in January 2026. Of every song someone could have planted on his channel, they chose the one he tried to sue out of existence.
The d4vd angle proved the most disturbing. The falsified track I DID IT surfaced on his Apple Music page despite the artist, born David Anthony Burke, remaining behind bars without access to upload music himself. His profile also displayed tracks titled I'm Sorry, I Love You Celeste and I'll See You in Hell, Celeste. None of these were real releases. Burke faces first-degree murder charges for allegedly killing and dismembering 14-year-old Celeste Rivas Hernandez, and his preliminary hearing was underway in Los Angeles at the time the uploads appeared. Apple Music scrubbed the fake song by July 27.
To be clear: the uploads are not evidence, confessions, or legitimate releases. They were unauthorized, and Burke has pleaded not guilty to all charges. His attorneys have stated they "will vigorously defend" his innocence.
Despite the scale, the incident drew limited mainstream coverage. YouTube and most affected artists had not publicly explained how the content reached their official pages as of Sunday evening. Social media users initially described the wave as a coordinated hacking campaign, though posts circulating online claimed the uploads were likely made through distribution service exploits rather than direct account breaches.
No account credentials appear to have been compromised. The uploads were delivered through a music distributor with weak moderation, and YouTube's automatic artist-matching did the rest. An X user who compiled the first comprehensive list of affected artists pointed to OffStep as the distributor involved. Any distributor that accepts a delivery under a major artist's name without a rights check exposes the same hole, and YouTube's name-based ingestion pipeline converts that gap into a direct line to a verified page.
That systemic question is where this story goes next. Whether YouTube tightens ingestion for high-profile artist names, or distributors face harder identity requirements, will determine if this weekend was a one-off or a preview.
Check topics and authors from this story to see more stories like this in your personalized feed and receive updates when new work is published.
