On October 22, 2026, the Justice Department announced that Joseph Strange, 48, of Holly, Michigan, pleaded guilty in the U.S. District Court for the Eastern District of Michigan to criminal infringement of copyright. Strange worked for Marshall Mathers, known as Eminem, from about 2007 to 2021. According to court documents, he used access he held as a trusted technical insider to copy unreleased music and sell it to buyers online.
There is no classified information in this case, but the pattern will be familiar to every insider threat program: a long-tenured, trusted employee who built and ran the system, high-value data on password-protected drives, and a quiet sale that surfaced only after the damage was public.
What happened
- Strange worked for Mathers from about 2007 to 2021 at a studio in Ferndale, Michigan.
- He helped set up and operate the computer system that stored Mathers’s music, and he had access to password-protected drives holding unreleased material.
- Without authorization, he copied at least 10 audio files in various stages of development.
- Between July and August 2024, about three years after his employment ended, he sold and transmitted at least 10 of those files to buyers over the internet for about $50,000. Mathers did not know of or authorize the sales.
- The files were later released on public streaming platforms. Some had been prepared for possible commercial release, in some cases including studio mastering.
- The government says the infringing files had been accessed more than eight million times as of November 2025, with an estimated infringement amount of at least $750,000.
- Strange faces up to five years in prison. Sentencing is set for January 27, 2027. The FBI Detroit Field Office investigated.
Assistant Attorney General A. Tysen Duva said Strange “abused a position of trust to unlawfully copy and sell unreleased music belonging to Eminem.” (Justice Department)
Lessons for every insider threat program
- Treat the system builder as a privileged user. The person who designs and runs a storage system knows where everything lives and how it is protected. Put administrators of crown-jewel repositories under user activity monitoring (UAM), separate administration from content ownership, and require a second person for changes to access on those repositories.
- Know where your crown jewels are and who can copy them. For a recording studio, unreleased masters are the most valuable data it holds. Every organization has an equivalent: proposal pricing, source code, technical data, controlled unclassified information. Inventory it, label it, and set data loss prevention (DLP) rules that flag bulk copies to removable media or personal cloud accounts.
- Make offboarding a control, not a formality. When a 14-year employee leaves, disable accounts the same day, rotate passwords on any shared or password-protected drives they administered, recover devices and media, and review their recent file activity. Password protection only works if the people who leave no longer know the passwords.
- Watch the outside, not just the network. Here the sales happened in 2024 and the harm became visible when the tracks appeared on public platforms. Monitoring for your own data appearing outside the organization, and having a playbook to trace a leak back to its source, turns a public embarrassment into an investigative lead.
- Tenure is not a risk control. The trust built over years is what gave this insider his access. Continuous evaluation should cover long-tenured staff, contractors, and former employees with any residual access, not only new hires.
How TMPC helps
This case comes from the entertainment industry, but the controls that would have caught it are the same ones that protect defense programs, proposal data, and controlled information. Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to a DoW (DoD) customer.
- User activity monitoring (UAM) and insider threat analysis focused on privileged and high-access users
- Insider threat program development, policy, and training
- Access reviews, offboarding procedures, and data loss prevention assessments for your most sensitive data
To talk with our team, contact info@tmpcinc.com or 813.524.6935.