Email from no-reply@spotify.com about data leak and changing password

[Lailonwen]

Hi guys,

Just received an email asking to change my password because of a data leak at a different service. Was this mail really sent by spotify and if so, how do they know where I (if so) use the same password. Also – if so – where was the data leak?

[Maxim]

Hey @Lailonwen,

Yes these emails are usually from Spotify. As far as I know, there hasn’t been a leak and everyones details are safe. Spotify proactively changes passwords when they hear news that there may possibly have been a leak from another company.

Hope this helps 🙂

[Lailonwen]

Thanks Maxim! 🙂

If it was from spotify, it would be nice to know what service they are talking about where there might have been a leak, so that one could change the password there, too. 😉

Besides that... I am wondering why they might know that someone uses the same password somewhere else. Afaik those are not supposed to be saved in clear writing? Just curious how this might be matched...

[Maxim]

Unfortunately, i have no information about the name of the service.

I believe that sometimes databases from other services are leaked that contain things such as email address, username, name etc. That way, Spotify may be able to match the email address with an existing account and send them an email telling the user to reset their password.

[Lailonwen]

Might be.. apparently another user received the same email and is very sure about not using the same password twice...

https://www.gutefrage.net/frage/virus-oder-unberechtigte-tat-von-soptify

so maybe it's just a precaution which is communicated in a misleading way that caused me a little confusion. 😉

[Maxim]

Well.. if you think that the email is suspicious please take a look at this support article: https://support.spotify.com/account_payment_help/privacy/suspicious-email/

Thanks!

[Lailonwen]

Oh thank you. I followed the instructions – just to be sure.

Have a nice evening!

[Lailonwen]

Received feedback from support today, confirming that the email was sent by spotify.

I am now waiting for feedback if they can tell me where the leak was and how the passwords of different services are matched.