So, yeah. Other than stated, Spotify does not provide 2FA (shame on them!), so I use a strong password and since years nothing happened.
This early morning I got multiple mails that my account was logged in from Brazil, from the USA, from India, and some other countries. There were songs liked and playlists created so it wasn’t a malicious e-mail but some people actually were able to log on to my Spotify account.
I of course changed the password and logged out all accounts and checked allowed apps, etc. and everything looks fine.
But I wonder … was there something that happened recently? The common sites to check such things do not list my old Spotify password, and a quick web research does not bring anything up.
Any clue what could have happened here?
Have you logged into/used spotify on any public networks or potentially compromised private networks (e.g. that friend who’s really careless with what prograns they run)?
Any chances your device(s) itself has been compromised?
Did you link Spotify with any questionable websites?
Nowadays there’s more than one way to hijack accounts, and a password/2FA isn’t necessarily needed—e.g. session hijacking
Nope, no logins on devices I do not own. I have it on my smart home devices and on my cellphone. The phone is connected to carrier network and free access points from our public transport company and in the office WiFi.
I didn’t link Spotify anywhere. My devices are likely not being compromised. On my phone I use open source software where possible and only very little apps in general, and all network traffic is very restricted with NetGuard in whitelist mode. So someone else or me or my tools would have noticed any fishy things happening on that side.
I could not say where someone could get the two sessions (my smarthome system and my phone) from based on my usage either …
It’s all just very strange.