spotify.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting Spotify, with over 34 million total events recorded between July 2025 and June 2026. The majority of these events, approximately 81%, are attributed to historical data breaches, while 19% are linked to active infostealer logs. The data suggests a widespread compromise affecting over 34 million client accounts and a smaller number of employee accounts. The primary malware families observed are LummaC2, Redline, and Rhadamanthys, all known for credential theft. The targeted services include Spotify's account login pages and the Android application, with a notable concentration of affected users in Brazil, the United States, and India. The leak repository classification indicates that the majority of exposed data originates from combolist sources, suggesting large-scale credential stuffing or account takeover attempts.