A hacking group has managed to gain unauthorized access to 350,000 Spotify accounts on the music streaming service . To achieve this, they used login credentials stolen from other data breaches and, of course, a lot of patience on their part.
The success of the attack was largely due to the fact that Spotify account holders reused passwords from other accounts they had. So all the hackers had to do was simply try combinations on Spotify, a technique known as credential stuffing.
The hackers, however, made a mistake, as they themselves were the ones who exposed their activity by storing the files in an unsecured cloud. This meant that anyone with a web browser could view the data without needing a password.
Security researchers Ran Locar and Noam Rotem found the exposed files as part of a study scanning the Internet for unsafe data. The researchers, who were looking for unsafe data, published their findings on security website vpnMentor on Monday.
Locar and Rotem are not sure that the data was not discovered by someone else, as there are many who scan the internet for exposed data.
What users should remember is that they should not reuse their passwords.
Stolen Spotify accounts could be rented to other users at a discount. They could also be used for “streaming manipulation,” which, as Rolling Stone in 2019, is a major concern in the recording industry. The practice involves orchestrating accounts on a music streaming service to boost the numbers for a song if someone is willing to pay for such a service.
Spotify has reset passwords for affected users, ending the usefulness of the stolen data. The company advises its customers to never reuse passwords and offers more tips on its website for protecting their account security.
Locar and Rotem also found IP address records, which they determined were likely related to proxy servers that the criminals used to disguise their location while carrying out their activities. These details, along with the records of the exposed accounts, could help Spotify identify activity originating from the criminal ring.
