Updated security notice

It seems that there is some confusion about who may be at risk due to the recently communicated leak of information that could be used to guess some user’s password. To clarify, your password is at risk only if all of the following apply:

  • You had a Spotify account before December 19th, 2008
  • You have not changed your password since December 19th, 2008
  • You have a weak password
  • Someone from a small group of people asked our servers specifically to see your account details before that date
  • Someone from the same small group decided to put computation time towards guessing your password

If your Spotify account was created before December 19th, 2008 you should have received an email about the issue by now, assuming that the email address you stated when registering the account was correct.

Spotify security notice

Last week we were alerted to a group that managed to compromise our protocols. After investigating we concluded that this group had gained access to information that could allow rapid testing of password guesses, possibly finding the right one. The information was exposed due to a bug that we discovered and fixed on December 19th, 2008. Until last week we were unaware that anyone had had access to our protocols to exploit it.

Please see the updated security notice for clarifications!

Along with passwords, registration information such as your email address, birth date, gender, postal code and billing receipt details were potentially exposed. Credit card numbers are not stored by us and were not at risk. All payment data is handled by a secure 3rd party provider.

If you have an account that was created on or before December 19th, 2008, we strongly suggest that you change your password and strongly encourage you to change your passwords for any other services where you use the same password.

When choosing your password we provide you with an indicator of the password strength to help you choose a good one. To change your password please visit your profile page on our website.

https://www.spotify.com/account/profile/

For the technically minded amongst you, the information that may have been exposed when our protocols were compromised is the password hashes. As stated, we never store passwords, and they have never been sent over the Internet unencrypted, but the combination of the bug and the group’s reverse-engineering of our encrypted streaming protocol may have given outsiders access to individual hashes.

The hashes are salted, making attacks using rainbow tables unfeasible. Short or otherwise bad passwords could still be vulnerable to offline targeted brute-force or dictionary attacks on individual users, but you could not run attacks in parallel. Also, there has been no known breach of our internal systems. A complete user database has not been leaked, but until December 19th, 2008 it was possible to access the password hashes of individual users had you reverse-engineered the Spotify protocol and knew the username.

We are really sorry about this and hope you accept our apologies. We’re doubling our efforts to keep the systems secure in order to prevent anything like this from happening again.