The betrayal didn’t come from a hacker. It came from inside the family.

Eminem keeps his music securely stored in his Ferndale, Michigan recording studio and only a handful of people know the passwords. The unreleased music—songs born out of pain, rage, trauma and survival—was stored not in the cloud but in locked safes and offline hard drives.

And when the music was found online, the few employees knew this wasn’t just another celebrity data breach. This was something deeper. More intimate. More violating. And when the FBI finally traced it all back, it led not just to a former employee, it pointed to Em’s inner-circle.

Joseph Strange, 46, had spent years inside the studio where Eminem (real name Marshal Mathers) built his legacy. He wasn’t a name in the liner notes. He was the guy behind the systems, the one making sure the hard drives worked, backups backed up, safes stayed shut. He knew every digital folder. Every password.

He was also the nephew of Mike Strange, Eminem’s right-hand engineer, a man so close he might as well be blood.

The Strange men, though technically uncle and nephew, were raised more like brothers. Music was their bond. So was Eminem. The trust ran so deep that no one thought to question it. Until unreleased tracks— more than two dozen of them—started showing up on Reddit, YouTube and black-market fan forums in early 2025. Songs written between 1999 and 2018. Some finished. Most not. None of them ever meant to leave the room where they were born.

“The studio where the music is kept is the personal studio of Mathers. The public is not allowed in the studio and only employees and invited guests are admitted. Mathers uses the studio to create the music that is ultimately sold and distributed to the public.”

Brian C. Max, Special Agent, FBI

Max and the FBI got the call on January 16. By January 28, they were inside Joseph’s house in Holly, Michigan, and what they found was staggering: 12,000 audio files.

Original handwritten lyric sheets by Eminem. A VHS tape with an unreleased music video. And the hard drive maps, those digital fingerprints, identical to the ones inside the Ferndale studio’s most secure safe.

The whole thing unraveled because of a fan.

A teenager in the United Kingdom saw a tweet from Eminem’s business associate, Fred Nasser, asking followers not to share the stolen songs. He reached out. He had screenshots. Conversations. Proof.

He’d been talking to someone named “Doja Rat,” who boasted about buying Eminem’s unreleased tracks from a man named Joseph Strange. The fan passed the messages to the FBI. One read: “He used to work for Em… I gave him $50K. He needed the money for surgery.”

Doja Rat was real. A 31-year-old Canadian bank employee and die-hard Eminem fan. He confessed to the FBI that he’d met Joseph through a YouTube channel called “Dope Edit,” which hosted rare and remixed Eminem songs. The two began chatting on Discord. Then Signal. Then, Joseph — under an alias — offered him access to unreleased tracks.

At first, the price was $8,500 for four songs. All payments in Bitcoin.

Doja Rat didn’t have the money, but he knew people who did. He and a group of collectors pooled resources. Took out lines of credit. Sent the Bitcoin. Over six months, they paid out nearly $50,000. In return, they received dozens of tracks — and eventually, high-resolution photos of original lyric sheets, allegedly rescued by Joseph from a studio flood.

That story — the flood, the cleanup, the chance to quietly pocket handwritten pages — was compelling. So was Joseph’s pitch: this wasn’t theft. This was memorabilia. This was history.

But the FBI didn’t see it that way. Neither did Eminem’s manager, John Fisher.

“Fisher was able to identify these as images that were taken directly off the hard drive in the studio labeled “Raid I.” Fisher confirms that Joseph Strange did not have permission to possess/sell these items,” according to Special Agent Max.

Back in Ferndale, Fisher opened the studio vault and checked the hard drives. One, labeled “RAID 1,” hadn’t been touched in years. Its logs told a different story: files had been removed on October 16, 2019, and again on January 16, 2020. At the time, Joseph still worked at the studio.

Mike Strange told investigators that only four people had ever had access to those drives — himself, Tony Campana, Fisher, and Joseph. All of them, except Joseph, still worked there. All had been interviewed. All denied leaking anything.

Mike was blunt: “This music could have only come from someone who has direct physical access to the hard drives.”

Tony Campana agreed. So did Fisher, who personally identified the folder structure and lyric sheets recovered from Joseph’s home as exact matches to those in the vault.

One photo of a computer screen sent to Doja Rat contained the full listing of unreleased Eminem songs, in alphabetical order. Fisher said it was the same list found on the studio’s RAID 1 drive — a drive stored in a locked safe, disconnected from the internet and protected by a shared password used only by the four employees.

The kind of drive that only Joseph could have accessed, and copied, when no one was looking.

Eventually, the digital trail led everywhere.

The FBI tracked Bitcoin wallet addresses, examined Venmo test payments, and traced IP logins tied to email aliases Joseph used. They spoke with other buyers, including “ATL” and “Kali Kush,” fan aliases who independently confirmed Joseph’s identity. One fan paid through a Venmo account labeled “Hal Finney,” an obvious nod to Bitcoin culture. The account led directly to Joseph — his home address, social security number, and even one of the email addresses he used to send the leaked songs.

There were attempts to obscure it all, but not enough. The receipts told the story. So did the NDA.

When Joseph left the studio in 2021, he signed a non-disclosure agreement as part of his severance. He agreed, in writing, not to “post, transmit, or otherwise circulate” any photos, videos, or audio “of or concerning” Eminem or his associates. He acknowledged the importance of protecting “intellectual property,” including “masters embodying Artist’s performances” and “handwritten lyrics.”

Then he took them anyway.

The betrayal stung.

Not just because it was calculated. But because it was close. Because it wasn’t done by some faceless cybercriminal or opportunistic hacker. It was done by someone who used to sit in the same rooms. Who grew up in the same family. Who was trusted with the music before it had a name, a beat, or a hook.’

“Mike Strange is the uncle of Joseph Strange, but the two were raised together and consider themselves brothers.”

Special Agent Brian C. Max

In March, the U.S. District Court for the Eastern District of Michigan formally charged Joseph Strange with criminal copyright infringement and interstate transportation of stolen goods. He hasn’t spoken publicly. The case will likely head to trial.

For now, the music’s back in the vault. The passwords are changed. The drives disconnected. But the leak changed something — not just for Eminem, but for the small group of people who thought their circle was unbreakable.