4 ms·
Ask HN: Has Spotify been breached?
So according to haveibeenpwned my email is not listed as being on any Spotify breach, but I just got 2 emails that my email and password were on a paste for my Spotify Premium account.
Makes sense now, as a couple of hours ago listening at work, it stopped playing and said it was playing on a LG Phone ... so logged all out and changed password.
I can't seem to find anything other than 2016, and https://www.digitalmusicnews.com/2017/12/27/spotify-massive-data-breach/ from last year.
- IpV8 9y agoHappened to me last week. Music stopped playing, said it was playing on some iphone, and now all of my recently playeds are bands I've never heard of. I changed password and it hasn't happened since. Something fishy is going on.
- IpV8 9y agoJust happened to me again. Now all of my playlists are gone and replaced by trap shit.
- graystevens 9y agoWere they unique and/or generated passwords each time, or was it a password you have used else where? It is unlikely to be a Spotify breach, but if the password was unique to Spotify then that certainly adds a little more weight to the argument. Usually it is simply a case of ‘credential stuffing’, where other data breaches are checked against other common/popular websites, with the goal of finding accounts that work and can be sold to others for illegal use (TV streaming services etc.) Overview of credential stuffing can be seen here: https://breachinsider.com/blog/2017/credential-stuffing-how-breached-credentials-are-put-to-bad-use/ https://breachinsider.com/blog/2017/credential-stuffing-how-...
- IpV8 9y agoDefinitely possible. I don't do completely unique passwords, but do do a tweak on a standard password that was unique to my spotify account. Also a quick google of 'pastebin spotify 2018' shows quite a few lists of emails and passwords posted rather recently. I suppose there is no way to know one way or another, either way I just went in and randomized my bank/email passwords to be safe.
- gargravarr 9y agoHere's the paste: https://pastebin.com/ETdwyS48 https://pastebin.com/ETdwyS48 Only ~30 entries but no reason to think it's not a snippet of a much larger leak. Email, Premium level (seems to be Premium accounts only?) and... >_<... plaintext passwords.
- throwaway413 9y agoHappened to me a couple weeks ago. They messed with my playlists and added a bunch of Portuguese songs to my library.
- to-too-two 9y agoHappened to me a few days ago. Thought it was just a fluke, but this confirms that there definitely was a breach. Spotify should make a public announcement about this. I logged in the other day and all my playlists had been deleted and replaced with one or two weirdly named ones. Changed my password, and it's been okay so far.
- laken 9y agoI wouldn’t think it was a breach, but rather a bunch of cracked accounts (probably using other breaches - credential stuffing). Spotify Premium accounts are a large target, because they can be sold for a few bucks a pop. What they’re really going for are Spotify Family accounts, because then they can sell “Premium Upgrades” using the empty slots on the family account.