[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Spotify Resets User Passwords to Protect Against Third Party Data Breaches](/blog/spotify-resets-user-passwords) Publish date January 8, 2025 {x} minute read # Spotify Resets User Passwords to Protect Against Third Party Data Breaches [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [UpGuard Team](/team/upguard) UpGuard Team Reviewed by Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) For Spotify CEO Daniel Ek, the goal for the rest of 2016 should be simple: don’t rock the boat. The Swedish music streaming service, which is [widely expected to go public late next year](https://www.bloomberg.com/news/articles/2016-07-20/will-a-spotify-ipo-live-up-to-its-8-billion-valuation), is already locked in enough significant conflicts to occupy most of Ek’s waking hours. Apple, besides choking off Spotify updates via the App Store, increasingly poses a competitive threat with its well-funded [Music division](https://www.forbes.com/sites/hughmcintyre/2016/09/03/apple-music-introduces-spotify-like-weekly-playlists-for-every-user/#5caa689b35e0). Record megalabels, reluctant to conclude long-term agreements with Spotify for access to their catalogues, nevertheless command [over half of the company’s revenues](https://www.fool.com/investing/2016/08/30/spotify-ipo-prospects-continue-to-worsen.aspx) via royalty payments - the major contributor to Spotify’s continual operating loss. Recording artists, dissatisfied with their cut of the proceeds, face [possible retaliation](https://www.bloomberg.com/news/articles/2016-08-26/spotify-said-to-retaliate-against-artists-with-apple-exclusives) if they make it publicly known - a nasty public profile for a company to cut against musicians with rabidly loyal fan bases. Even as Spotify continues to attract paying subscribers - the count as of August hovered around thirty-nine million such users - a cloud of uncertainty hovers around the question of the corporation’s long-term viability. No use adding to these public relations woes - which was why reports of a possible [data breach](/blog/data-breach) proved, surprisingly, to be a refreshing bit of news for Spotify.  On August 31st, users reported receiving email notifications that their passwords had been forcibly reset. While in the past, Spotify has been accused of [failing to guard against the theft of user information](https://techcrunch.com/2016/04/25/hundreds-of-spotify-credentials-appear-online-users-report-accounts-hacked-emails-changed/), the [email](https://www.businessinsider.com.au/spotify-users-password-reset-not-hacked-other-companies-data-breaches-reuse-account-logins-2016-9?r=US\&IR=T) made it clear that this was a proactive measure: “We believe \[your password] may have been compromised during a leak on another service with which you use the same password. Don’t worry! This is purely a preventative security measure. Nobody has accessed your Spotify account, and your data is secure.” **"An unprecedented amount of our personal information resides online."** ## Password Reuse With no indication (thus far) of such a breach of Spotify information, this is good news for online consumers everywhere, and a shrewd precaution that other internet companies should emulate. With the revelations this year that websites like [Dropbox](https://www.vice.com/en_us/article/nz74qb/hackers-stole-over-60-million-dropbox-accounts), [LinkedIn](https://www.vice.com/en_us/article/78kk4z/another-day-another-hack-117-million-linkedin-emails-and-password), and [MySpace](https://www.vice.com/en_us/article/pgkk8v/427-million-myspace-passwords-emails-data-breach) have suffered massive losses of login information at the hands of hackers, it pays more than ever to err on the side of caution: so long as it remains common practice for most internet users to reuse passwords across multiple websites, it will remain possible for thieves to steal a user’s password from one site, then use it to unlock their accounts on dozens more. With the expansion of online firms to service almost any need, from banking to apartment hunting to [beef jerky,](https://www.amazon.com/Amazon-JK29LP-Slim-Dash-Button/dp/B01C3J9YKC/ref=sr_1_23?s=digital-text\&ie=UTF8\&qid=1473061459\&sr=1-23) an unprecedented amount of our [personal information](https://www.upguard.com/blog/personally-identifiable-information-pii) resides online - for most of us, atop the flimsy reed of an email address and a favorite password. It’s not difficult to see how password reuse attacks might constitute one of the most formidable cybersecurity threats facing the online marketplace today. Consider this figure, from Tom Spring at [ThreatPost](https://threatpost.com/no-simple-fix-for-password-reuse/118536/): “The average number of accounts registered to one email account for 25-34-year-olds is more than 40, according credit-checking firm Experian...on average, users had only five different passwords for those accounts.” That Bank of America account? That Hulu password? Your Instagram login information? Have you individually created and memorized random character string passwords for each - or, more likely, entered your pet dog’s name for each, grumbling about onerous password requirements like the use of at least one number? Perhaps you do employ a bit of discretion, employing a cloud manager to keep track of your alphabet soup of passwords. That’s better - unless your password manager should be breached, as happened to the [popular LastPass in 2015](https://www.gizmodo.com/2015/06/am-i-an-idiot-for-still-using-a-password-manager/). [iPhone users can take advantage of its compromised credentials detection feature](https://www.upguard.com/blog/this-password-has-appeared-in-a-data-leak), which also checks for reused password and prompts users to change them. ## A Chain Reaction Don’t beat yourself up too much for recycling your login information - it’s human, it’s understandable, and no less a tech wunderkind than Mark Zuckerberg has [fallen prey to its consequences](https://techcrunch.com/2016/06/06/zuckerbergs-twitter-pinterest-linkedin-accounts-hacked/). But the results of a password reuse attack can be devastating - a chain reaction of concatenating breaches, with each exposing more and more users to widening data theft. **"A massive breach of LinkedIn data resulted in 117 million accounts being compromised."** Consider the circuitous way in which Zuckerberg’s Pinterest account was reportedly hacked. In 2012, a massive breach of LinkedIn data resulted in 117 million accounts being compromised, with millions of usernames and passwords posted online. As Techcrunch [reported](https://techcrunch.com/2016/05/18/117-million-linkedin-emails-and-passwords-from-a-2012-hack-just-got-posted-online/), “because the passwords were stored as unsalted SHA-1 hashes, hundreds of thousands were quickly cracked,” with [no clear indication how many more](https://www.vice.com/en_us/article/78kk4z/another-day-another-hack-117-million-linkedin-emails-and-password) might be entirely exposed. Security expert Jeremi Gosney [deemed](https://arstechnica.com/information-technology/2016/06/how-linkedins-password-sloppiness-hurts-us-all/) it “the largest and most relevant publicly acknowledged password breach in Internet history,” estimating that “if you had a LinkedIn account in 2012, there's a 98 percent chance your password has been cracked.” Among those LinkedIn users victimized, [taunted his hackers](https://techcrunch.com/2016/06/06/zuckerbergs-twitter-pinterest-linkedin-accounts-hacked/), was Mark Zuckerberg, who had evidently reused his LinkedIn password when registering for Pinterest. LinkedIn handled the breach remarkably poorly, [failing to level with consumers](https://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised) on the full breadth of the threat until it was [exposed](https://www.vice.com/en_us/article/78kk4z/another-day-another-hack-117-million-linkedin-emails-and-password) by a hacker attempting to sell the data online this summer - four years after the initial theft. Given the prevalence of password reuse, it wasn’t merely LinkedIn that was compromised by the hack; by failing to effectively [encrypt](/blog/encryption) the stolen passwords, the firm [bequeathed](https://techcrunch.com/2016/06/06/zuckerbergs-twitter-pinterest-linkedin-accounts-hacked/) “a massive insecurity legacy by providing hackers with huge amounts of real-world password data to improve their password-cracking abilities.” This was no mere theory. Among the millions of LinkedIn passwords stolen in the 2012 incident was that of an [unnamed Dropbox employee](https://techcrunch.com/2016/08/30/dropbox-employees-password-reuse-led-to-theft-of-60m-user-credentials/) who had reused the same email and password combination for his work account. Using these credentials, hackers accessed the employee’s Dropbox account - and within it, a file containing the credentials for [a further 60 million Dropbox accounts](https://www.vice.com/en_us/article/nz74qb/hackers-stole-over-60-million-dropbox-accounts). While these passwords were fortunately hashed and salted, stymying a similarly devastating exposure of credentials, Dropbox also wisely undertook a [forced password reset](https://www.vice.com/en_us/article/nz74qb/hackers-stole-over-60-million-dropbox-accounts) for affected accounts this August when the data set reemerged on the [dark web](/blog/dark-web). ## Why Password Encryption Matters The online criminal economy features [a burgeoning black market for stolen data](https://www.cnbc.com/2016/07/22/hacked-spotify-hulu-accounts-fetch-millions-for-data-thieves.html), in which identity thieves and scammers are eager customers. If this underworld has a major weakness, it is its reliance on access to lightly or unencrypted passwords as the chink in the armor through which they can gain access to more data. Due to effective password [encryption](/blog/encryption), it seems the fallout for Dropbox users was limited - as Motherboard [reports](https://www.vice.com/en_us/article/nz74qb/hackers-stole-over-60-million-dropbox-accounts), “the Dropbox dump does not appear to be listed on any of the major dark web marketplaces where such data is often sold...the value of data dumps typically diminishes when passwords have been adequately secured.” Likewise, Tumblr, despite losing the credentials of 65 million accounts to a [2013 data breach](https://www.vice.com/en_us/article/8q88k5/hackers-stole-68-million-passwords-from-tumblr-new-analysis-reveals), could at least take comfort in having thoroughly hashed and salted the passwords - rendering the data set into little more than a long list of emails, sold for a measly $150 on a dark net site. If there is a takeaway here, it is that sturdy password encryption can have a remarkably outsized impact on the ability of hackers to [exploit](/blog/exploit) data breaches.       **"Sturdy password encryption can have a remarkably outsized impact on the ability of hackers to exploit data breaches."** What then can Joe Average do to safeguard their online activity? Unfortunately, the proliferation of unique account registrations across your dozen favorite websites is not going away any time soon. When available, [two-factor authentication](https://www.upguard.com/blog/two-factor-authentication), of the sort [Twitter offers](https://www.cnet.com/how-to/how-to-enable-twitters-two-factor-authentication/), can protect your credentials behind an extra layer of security - necessitating access to your phone, for example, in order to login. Using randomized, complex, multivaried passwords for each account may not be convenient, but certainly makes the job harder for the bad guys. Regularly updating your passwords is also crucial - if you hadn’t changed your LinkedIn password since 2012, for example, your credentials may have been exposed years later. Judicious use of a password manager can help you keep track of it all - and while cloud-based programs can be compromised, the [addition of a thumb drive as a second-factor authenticator](https://www.lifehacker.com/2012/01/how-to-build-a-nearly-hack-proof-password-system-with-lastpass-and-a-usb-drive/) can make it extremely difficult for your master password to be cracked. As always, it pays to be proactive. Reports that [200 million Yahoo accounts had been compromised in a data breach](https://threatpost.com/yahoo-investigates-200-million-alleged-accounts-for-sale-on-dark-web/119624/) were not confirmed by the company, which also did not issue preemptive password changes. When in doubt, why not take the initiative and update your password yourself? ## Transparency as a Public Good While corporations can only do so much to encourage password hygiene among their users, they owe it to their customers to ensure they are as creative and proactive as possible in combating data theft. In each of these “megathefts,” internet firms were typically opaque in sharing details with the public - failing to reveal how many user accounts had been compromised, how well their IT professionals had encrypted stolen passwords, or what credentials hackers had acquired. Transparency on how companies protect information is a practical good for the public, especially as hacks continue to have repercussions years after the crime. Spotify provides a good example of how an intelligent company might seek to safeguard its user information. As Gizmodo’s William Turton [writes](https://www.gizmodo.com/2016/09/why-spotify-just-forced-some-people-to-reset-their-passwords/), “By analyzing publicly available password dumps against their own user database, Spotify can reset the password of users found in the dump, thus making them safe from a hackers who might exploit people’s password reuse.” It’s smart, it’s practical, and it is a policy that could have far-reaching effects in slowing the spread of data breaches, restraining hackers from leapfrogging across the internet and acquiring the keys to the kingdom. *Take a look at *[*UpGuard*](/)*'s free *[*Password Security Handbook*](/blog/the-password-security-checklist)* to see what you can do to keep your own online identities secure.* eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)