Every Password in This 387,436-Record Spotify Combolist Is Plaintext

400K Spotify Hits Mix: 387,436 Streaming Logins Leaked

In April 2026, HEROIC analysts identified a large combolist named 400K Spotify Hits Mix GEOApril_2026, uploaded to Telegram. The verified file contained 387,436 records pairing email addresses with plaintext passwords, along with the URLs each login was tied to. The naming suggests the credentials were filtered specifically for Spotify accounts, making this a targeted list rather than a generic mix.

Why Every Password Being Plaintext Matters Here

With 387,436 records and every password stored in plaintext, this file requires zero effort to weaponize. An attacker can load the entire list into automated login software and test hundreds of thousands of email and password combinations against Spotify, and against any other service, within hours. Streaming accounts also carry saved payment cards, which turns a simple login into a direct path toward financial fraud.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs (the login pages tied to each account)

Why This Matters

A combolist of nearly 400,000 records is exactly the kind of resource that powers large-scale credential stuffing campaigns. Because the passwords are unencrypted, attackers can move straight from download to attack. Anyone in this list who reused their Spotify password elsewhere is exposed to account takeover, identity theft, and financial fraud well beyond music streaming.

How a Service-Specific Mix List Gets Built

Sellers build lists like this by filtering a much larger pool of stolen credentials down to accounts tied to one platform, then labeling the file by service, region, and month, as seen in the "GEOApril_2026" tag here. This packaging makes it easier for buyers to target a specific group of victims rather than sorting through unrelated data.

Check If You Are Affected

With 387,436 records in this single file, the chance your information is included is significant. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one, so you can find out now and change any reused passwords before someone else does.