Security News > 2021 > February > Spotify Suffers Second Credential-Stuffing Cyberattack in 3 Months

Spotify streaming music aficionados are in the crosshairs of yet another credential-stuffing cyberattack, just three months after the last one.

Back in November, cybercriminals attacked hundreds of thousands of Spotify users utilizing this approach, prompting the streaming music service to issue password-reset notices.

Researcher Bob Diachenko tweeted about the new Spotify attack on Thursday: "I have uncovered a malicious #Spotify logger database, with 100K+ account details being misused and compromised as part of a credential stuffing attack."

In the first Spotify incident in November, researchers found a misconfigured and open Elasticsearch cloud database containing more than 380 million individual records, including login credentials and countries of residence for various people, all being actively being validated against Spotify accounts.

On the surface, a cybercriminal being able to log into someone's Spotify account would seem to be more of a nuisance than anything else.

There's more to think about, Diachenko noted: For those who do reuse passwords, a validated Spotify log-in combo can simply be used to infiltrate other, higher-value accounts.

News URL

https://threatpost.com/spotify-credential-stuffing-cyberattack/163672/