Spotify has reportedly started resetting passwords for user accounts that may have been compromised. Researchers found a fraud scheme that could have been a credential stuffing operation. An open database containing more than 380 million records, including login credentials and other user data associated to Spotify was found, and the affected accounts are going to have their passwords reset. The report by the research team suspects around 300,000 to 350,000 users may have been affected by this hack of unknown origin and method.
As per the report published by the research team at vpnMentor, Spotify was targeted in a possible credential stuffing operation where hackers take advantage of weak passwords. The research team found an open database of over 380 million records associated to Spotify that included login credentials and other user data. Out of these records, around 300,000 to 350,000 users are suspected to be affected and as per the research, Spotify has initiated a ‘rolling reset’ of passwords for all users affected.
The database was over 72GB and was hosted on an unsecured Elasticsearch server. For now, the origin of the database and how the fraudsters were targeting Spotify are unknown. It is possible that the hackers stole login credentials from other platforms and tried to use them on Spotify.
The database was discovered on July 3 and reviewed on July 9. Spotify was then contacted and action was taken between July 10 and July 21. Initial findings were reported to Spotify and it was found that login credentials were probably obtained from an external site and used on Spotify accounts.
The research also mentions that this is a common tactic used by hackers and companies cannot do anything as it depends on a user’s password strength. Companies can help users regain control of their accounts and promote safer password practices.
Spotify has over 299 million active monthly users and is one of the most popular music and audio streaming services.
Which is the best TV under Rs. 25,000? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.
