Spotify

Summary

The streaming service Spotify inadvertently exposed user data to business partners as a result of a vulnerability in its system. This vulnerability existed as of April 9, 2020, was discovered on November 12, 2020, and fixed immediately. Though the data was not publicly accessible, affected data may include information provided for Spotify account registration, such as user email address and password, preferred display name, date of birth, and gender. As a precautionary measure, Spotify reset passwords for affected accounts and advised users to monitor accounts and change passwords on other accounts using the same email address and password combination. The NJCCIC reminds users to use strong, unique passwords for each account and enable multi-factor authentication where available.