Instead, you've made it easier for the attacker by using the same set of keys for more than one account. If the password, username and/or email address linked to just one of those accounts are exposed in a data breach or phishing attack, then all accounts using those credentials can be accessed, no matter how strong the password may be.Ĭredential stuffing isn't really a hack, since the attacker already has the 'keys' and is using the login software as it's designed.

How to make sure this doesn't happen againĬredential stuffing generally works only because most people use the same password for more than one account, or use simple, common passwords that can be easily guessed. You can check out your own email addresses and passwords at the (safe to use) website HaveIBeenPwned (opens in new tab). Virtually everyone who's ever had an online account has had something exposed. Of course, that's true whenever there's a large data breach exposing credentials.

'Fraudsters could also use the contact information to directly target the exposed users with phishing emails, tricking them into providing sensitive data like credit card details, or clicking a fake link embedded with malware.' 'Fraudsters could use the exposed emails and names from the leak to identify users across other platforms and social media accounts,' the report said. Spotify users in the database could also be vulnerable to phishing attacks and even identity theft, the VPNMentor researchers warned. Most well-known online services already offer 2FA, and it's time for Spotify to join them.

Without the 'second' factor - a texted code, an app-generated code, a specific smartphone or a physical security key - an attacker can't get into your account even with your password. You should also pester Spotify to offer two-factor authentication (2FA) as a security option to prevent exactly this kind of account takeover. We recommend using one of the best password managers to create and handle all those new passwords. If you're a Spotify user and you've used the same set of credentials - a password plus a username and/or an email address - for other accounts, you need to change the passwords on those accounts immediately.īe sure to make each new password long, strong and unique.

My spotify account was hacked