How a surgical hack exposed the fragility of global music streaming

Science · Published 30 October 2026 Swipe more like this →

In short: In March 2024, Spotify faced a sophisticated cyberattack that went beyond a simple data leak. By exploiting undocumented API endpoints and legacy protocols, hackers bypassed two-factor authentication to compromise 360 million accounts, revealing a fundamental tension between the scalability of modern streaming and the security of user data.

The breach on March 12, 2024, was characterized by its surgical precision. Rather than a chaotic brute-force attack, hackers utilized 'credential stuffing'—using login details from previous third-party leaks—combined with a deep, months-long mapping of Spotify’s internal systems. This allowed them to identify and exploit undocumented API endpoints, effectively bypassing two-factor authentication to exfiltrate partial datasets from 360 million accounts. The stolen data included email addresses, encrypted passwords, and session tokens. These tokens were particularly damaging because they could grant persistent access to accounts. Unlike the 2019 breach, which exposed 380 million emails, this incident allowed attackers to maintain access for up to 72 hours even after initial detection, turning a technical failure into a prolonged security nightmare for the platform. The attackers specifically targeted legacy authentication protocols to achieve their goals. This campaign was distinct from the more disorganized ransomware actions seen in 2022. Security researchers noted that the breach was a culmination of years of evolving threats within the digital music sector.

The fallout was both financial and reputational. Spotify's stock dropped 4.2% in after-hours trading, and independent artists faced targeted phishing scams. The incident reignited a long-standing debate regarding whether major streaming services prioritize rapid scalability over robust security infrastructure. It serves as a landmark case study in how the infrastructure of the modern music economy remains vulnerable to sophisticated, targeted exploitation. Podcast creators had to rush to alert their audiences about potential account takeovers. The event was described as a reputational earthquake for the company. It also sparked renewed discussions about security issues that first gained prominence during the 2018 Cambridge Analytica scandal.

]

General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.

Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?

Related

• How a simple social engineering scam hijacked 130 of the world's most powerful Twitter accounts.
• A multi-year social engineering campaign nearly gave hackers a master key to the internet
• When a massive data breach exposed millions, it revealed a digital house of cards.
• How a single configuration error exposed 72,000 women online
• A missing bounds check in OpenSSL code created the internet's most catastrophic security bug.
• From cave paintings to logos: branding is the human spirit manifested
• Spaceflight can trigger the reactivation of viruses that have been dormant for years.
• How demanding symmetry from nature reveals the hidden forces of physics
• The ingenious way Soviet smugglers used X-rays to bypass censorship
• Can we rewrite DNA to build a more sustainable future?
• Why do some English verbs become regular while others stay stubbornly irregular?
• The democratization of gene editing creates a new doomsday risk

More in Science · Latest · A–Z · All topics