Spotify Starts ‘Rolling Reset’ of User Passwords Found Victim to Possible Credential Stuffing Operation

Spotify reportedly see over 299 million active monthly users and is one of the most popular music streaming services.

By Vineet Washington | Updated: 25 November 2020 15:36 IST

Spotify Starts ‘Rolling Reset’ of User Passwords Found Victim to Possible Credential Stuffing Operation

Spotify and vpnMentor believe hackers obtained details from other platforms

Highlights

Spotify starts resetting passwords after an open database was discovered
This database contained 72GB of user information
Around 300,000 to 350,000 Spotify users may have been affected

Spotify has reportedly started resetting passwords for user accounts that may have been compromised. Researchers found a fraud scheme that could have been a credential stuffing operation. An open database containing more than 380 million records, including login credentials and other user data associated to Spotify was found, and the affected accounts are going to have their passwords reset. The report by the research team suspects around 300,000 to 350,000 users may have been affected by this hack of unknown origin and method.

As per the report published by the research team at vpnMentor, Spotify was targeted in a possible credential stuffing operation where hackers take advantage of weak passwords. The research team found an open database of over 380 million records associated to Spotify that included login credentials and other user data. Out of these records, around 300,000 to 350,000 users are suspected to be affected and as per the research, Spotify has initiated a ‘rolling reset' of passwords for all users affected.

The database was over 72GB and was hosted on an unsecured Elasticsearch server. For now, the origin of the database and how the fraudsters were targeting Spotify are unknown. It is possible that the hackers stole login credentials from other platforms and tried to use them on Spotify.

The database was discovered on July 3 and reviewed on July 9. Spotify was then contacted and action was taken between July 10 and July 21. Initial findings were reported to Spotify and it was found that login credentials were probably obtained from an external site and used on Spotify accounts.

The research also mentions that this is a common tactic used by hackers and companies cannot do anything as it depends on a user's password strength. Companies can help users regain control of their accounts and promote safer password practices.

Spotify has over 299 million active monthly users and is one of the most popular music and audio streaming services.

Which is the best TV under Rs. 25,000? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.