Raaga Music App Breach Leaks 10 Million Logins and Passwords

HEROIC analysts identified a data breach connected to Raaga, a music streaming service, exposing 10,221,163 records as of December 15, 2025. The exposed data includes email addresses, usernames, first names, password hashes, dates of birth, and gender. If you have ever signed up for this service, the only way to know for certain if your account is part of this exposure is to scan your email.

Why This Combination of Data Is Risky

A leaked password hash alongside a username and email address gives attackers a starting point to attempt to crack weaker passwords offline, then try those same credentials against other accounts where the password may have been reused. Pairing that with a date of birth and gender makes it easier to build a convincing profile for phishing messages or to answer security questions on other services.

Account Details Involved In This Exposure

• Email addresses
• Usernames
• First names
• Password hashes
• Dates of birth
• Gender

Why It Is Worth Taking Seriously

Password hashes can sometimes be reversed, especially when older or weaker hashing methods are involved, which means a leaked hash should be treated as if the underlying password itself were exposed. Combined with a known email and username, this creates a real risk of account takeover, not just on this service but anywhere the same password was reused.

How This Kind Of Exposure Happens

In an incident like this one, records are taken directly from a company's own systems rather than collected one at a time. HEROIC analysts found this data circulating after it had already been pulled from internal records, reflecting exactly what the company stored about its users.

Was Your Raaga Account Part Of This Breach?

Start by scanning your email to see if your account shows up in this exposure. If it does, change your password for this service right away, and update it anywhere else you may have reused the same one. This advice applies to personal and work email addresses alike, since either could be tied to an affected account.