The Spotify Hits Leak Means Someone Could Be Streaming as You

What HEROIC Analysts Found

In December 2024, HEROIC analysts identified a combolist file labeled "x400 Fresh Spotify Hits," uploaded to a Telegram channel. The file contained 328 records pairing email addresses tied to Spotify accounts with plaintext passwords and the URLs of the login pages they belong to.

Why This Is Dangerous

The word "hits" in this file's name means these are logins that were tested and confirmed to work on Spotify specifically. Anyone holding the file can sign into a real person's account, seeing their playlists, payment details on file, and account settings, all without the owner knowing.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

A Spotify account is often linked to a payment method and connected to other services through single sign-on. If someone reused their Spotify password elsewhere, a working login here could let an attacker try the same combination on email, banking, or shopping accounts through credential stuffing. Even a small batch like this one, "fresh" and confirmed to work, carries real financial and privacy risk for the people involved.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, usually gathered from earlier breaches, stealer logs, or leaked databases. Sellers who label a batch "fresh hits," as this one does, are marketing credentials that have already been run through checker tools and confirmed to log in successfully on a specific service, in this case Spotify.

Check If You Are Affected

If you use Spotify or any other streaming service, it is worth checking whether your login shows up in this leak or another. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out and update your password if needed.