In December 2020, Spotify encountered a data breach characterized by unauthorized access to user accounts. The breach stemmed from a credential stuffing attack, exploiting data from an external source rather than a direct breach within Spotify's security infrastructure.

How many accounts were compromised?

The breach impacted data related to approximately 500,000 individuals.

What data was leaked?

The data exposed in the breach included email addresses, along with associated Spotify account details such as usernames, passwords, and account types.

How was Spotify hacked?

The Spotify data breach occurred through a credential stuffing attack, where bad actors used a malicious Spotify logger database containing over 100,000 account details, likely leaked from another source. This allowed unauthorized access to Spotify accounts without directly compromising the platform's security. The vulnerability existed since April 9 but wasn't discovered until November 12, when Spotify took action to protect impacted users and remove the fraudulent database.

Spotify's solution

In response to the hacking incident, Spotify took several measures to enhance its security and prevent future breaches. The company issued password resets to all impacted users, rendering the exposed credentials invalid. Additionally, Spotify worked diligently to have the fraudulent database taken down by the ISP hosting it. While the platform's security was not directly compromised, these actions demonstrate Spotify's commitment to protecting user data and addressing vulnerabilities promptly.

How do I know if I was affected?

Spotify reached out to affected users and issued password resets to protect their accounts. If you're a Spotify user and haven't received a notification, you may visit Have I Been Pwned to check if your credentials were affected.

What should affected users do?

In general, affected users should:

1. Change Your Password: Immediately update your password for the breached account. Make sure the new password is strong and unique, not previously used on any other platform.

2. Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

3. Enable Two-Factor Authentication (2FA): Activate 2FA on the breached account and any other important online accounts to significantly reduce the risk of unauthorized access.

4. Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report it immediately to the respective platform.

For specific help and instructions related to Spotify's data breach, please contact Spotify support directly.

Where can I go to learn more?

If you want to find more information on the Spotify data breach, check out the following news articles:

• Spotify Hit with a Credential Stuffing Attack with Data from Another Breach

• Think your account's been hacked? - Spotify