The massively popular streaming service Spotify issued a data breach notice stating data exposed “may have included email address, your preferred display name, password, gender, and date of birth only to certain business partners of Spotify.”
The massively popular streaming service Spotify issued a data breach notice stating data exposed “may have included email address, your preferred display name, password, gender, and date of birth only to certain business partners of Spotify.”
Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics
Spotify is saying that only a small percentage of customers are affected, but their customer base is so vast that this could mean a thousand or a million people are affected. Breaches happen and loyal customers know this, but they expect transparency in order to preserve trust. The natural instinct is for an organization to withhold information after a breach, but there’s such a substantial gap between the time of exposure, April 9, and the date of discovery, Nov. 12, that real transparency is needed here. What kinds of account data has been exposed and how much of it? Spotify needs to hold themselves accountable.
The Data Breach Notification from Spotify and related password reset, highlights how software bugs and internal misconfigurations can go undetected for months while representing an active security risk. The proper tools, including security analytics, can help reduce the chance of data breaches by revealing unintended access paths due to misconfigurations and buggy software.