Security woes hit Spotify music service

Music service Spotify is the latest web darling to be hit by a security attack.

It's a popular, up-and-coming web service, so the time seems right for the bad guys to keep Spotify grounded by hitting it with a security breach.

Just days after signing up its millionth user, Spotify admitted that its security had been bypassed, with user information such as email, birth date, gender, post code and billing receipt details potentially open to hackers. Payment data such as credit card numbers are not held by the company, so were not at risk, it said.

The music service was alerted last week that its protocols had been compromised, allowing rapid testing of passwords. "The information was exposed due to a bug that we discovered and fixed on December 19th, 2008. Until last week we were unaware that anyone had had access to our protocols to exploit it," Spotify's chief technology officer Andreas Ehn wrote in the service's official blog.

Spotify was quick to clarify that the only users at risk were those with a weak password who signed up before 19 December last year and had not changed their password since that date. Any user fitting that description was sent a warning email and advised to change their password.

The data that was compromised were password hashes. Until that bug was fixed, "it was possible to access the password hashes of individual users had you reverse-engineered the Spotify protocol and knew the username."

"We are really sorry about this and hope you accept our apologies. We're doubling our efforts to keep the systems secure in order to prevent anything like this from happening again," Ehns wrote.

The Spotify attack follows security breaches at Facebook and Twitter.

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
350,000 Spotify users hacked in credential stuffing attack
Security

350,000 Spotify users hacked in credential stuffing attack

24 Nov 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
London ranks second to Silicon Valley as world's best startup hub
startups

London ranks second to Silicon Valley as world's best startup hub

22 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021