45 US Spotify Accounts Leaked With Plaintext Passwords in 2015

HEROIC analysts identified a database breach tied to Spotify, dated September 12, 2015. The breach is small in scope, just 45 accounts based in the United States, but it exposed a direct pairing of email addresses and plaintext passwords.

Why This Is Dangerous

With plaintext passwords, there is no hashing or scrambling standing between an attacker and a working login. Anyone in this group of 45 accounts has their exact password sitting exposed, ready to be used to log directly into their Spotify account or tested against other services where the same password might be reused.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

A Spotify password might seem low-stakes to protect, but people frequently reuse the same password across streaming accounts, email, and even banking logins. Attackers exploit this by taking leaked email and password combinations and running them through automated credential stuffing tools against dozens of other websites, hoping the same login works somewhere more valuable than a music app.

How Database Breaches Like This Happen

This incident is classified as a database breach, meaning a set of account records was pulled directly from a backend system rather than gathered one person at a time. Storing passwords in plaintext, without hashing them, is a serious security lapse, since it means every password becomes instantly usable the moment the underlying data is accessed or leaked.

Check If You Are Affected

If you have a Spotify account, or reused a password from around 2015 elsewhere, it is worth checking your exposure now. HEROIC's free breach scanner searches a database of more than 400 billion breached records to tell you instantly if your email address has been compromised.