Spotify Accounts Leaked: 41 Login Credentials Found on Telegram

HEROIC analysts found a combolist labeled 43 Spotify Accounts uploaded to a Telegram channel on 24 December 2022. Despite the name, the file actually contained 41 records pairing email addresses with plaintext passwords, along with associated URLs for the streaming accounts involved.

Why This Is Dangerous

With passwords stored in plaintext, anyone who downloads this file can read the credentials instantly and log into the affected Spotify accounts without any cracking or technical effort. A hijacked streaming account can also reveal saved payment details and personal information tied to the account.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Streaming service accounts like Spotify are frequently targeted because they are easy to resell and often share a password with more important accounts, such as email or banking. Attackers use combolists like this one to run credential stuffing attempts, testing the same email and password combination across other platforms. If any of these 41 people reused their Spotify password elsewhere, those other accounts are exposed to takeover too.

How Combolists Work

A combolist pairs email addresses or usernames with matching passwords in a simple text file, one record per line. Rather than being pulled fresh from an infected device, combolists like 43 Spotify Accounts are typically compiled from earlier leaks or scraped credentials, then repackaged and sold or traded on Telegram channels and dark web forums. Streaming account combolists are especially common because compromised logins are easy to resell to people looking for cheap access.

Check If You Are Affected

If you use Spotify or have reused a password across multiple accounts, checking your exposure is a quick way to protect yourself. HEROIC's free breach scanner searches more than 400 billion leaked records, including combolists like this one, so you can find out if your credentials are exposed and update any at-risk passwords.