Spotify Gets Hacked
Spotify, a music streaming service, has been targeted by hackers.
The Swedish company said that people’s personal details, such as e-mail addresses, dates of birth and addresses, were all stolen.
However, credit-card details, which were handled by a third party, are thought to have remained secure.
Spotify apologized for the lack of security, and has advised users that have registered before December 19, 2008 to change their passwords.
Hackers gained access to user data at the end of 2008, but the security breach only came to light at the end of last week.
Jim Butcher, Spotify’s communications manager, told BBC News that the company had only become aware of the attack after receiving a message from the hackers.
"We haven’t had direct contact, it’s all via third-party sources, so we don’t know who they are and we don’t know where they are from."
"This wasn’t some kid playing on a computer, someone has spent hundreds of hours looking to hack into our system."
"We’re still trying to find out the reasons they actually hacked our site, so it’s difficult for me to say what they want at the present time."
Spotify, which was launched in 2006, has over a million registered users. The company said that the number of compromised accounts was small.
"We think about 10,000 accounts [could be] at risk, although we are 95% sure it is a fraction of that," said Mr Butcher.
With Spotify, users pay a monthly fee to access music, or they can access it for free by listening to tunes that are interrupted by advertising.
The company explained how the hack actually took place in a blog posting.
"The information that may have been exposed when our protocols were compromised is the password hashes [codes]."
"As stated, we never store passwords, and they have never been sent over the internet unencrypted, but the combination of the bug and the group’s reverse-engineering of our encrypted streaming protocol may have given outsiders access to individual hashes."
Spotify is promising users that it is making efforts to ensure another hack is not going to be repeated.
—
On the Net: