Hackers just ‘backed up’ 86 million Spotify music tracks

In what surely amounts as one of the most brazen digital music heists of all time, a group of hackers says it has “backed up” Spotify’s music files and metadata, and it plans on releasing the files publicly in a massive “preservation archive.” 

In a blog post detailing its exploits, Anna’s Archives claims it managed to scrape 86 million Spotify tracks, representing more than 99 percent of the streamer’s “listens.” The group also nabbed the metadata for 256 million tracks, encompassing practically all of Spotify’s music catalog. 

The hackers say they will release the data—all 300TB worth—on peer-to-peer file-sharing networks in a “humble attempt to start…a ‘preservation archive’ for music.” For now, only the metadata has been released, according to Music Ally. 

Spotify offered the following statement to TechHive:

Spotify has identified and disabled the nefarious user accounts that engaged in unlawful scraping. We’ve implemented new safeguards for these types of anti-copyright attacks and are actively monitoring for suspicious behavior. Since day one, we have stood with the artist community against piracy, and we are actively working with our industry partners to protect creators and defend their rights.

While Spotify has far more than 86 million tracks in its music catalog, the songs scraped by the hackers represent the vast majority of Spotify’s most listened-to music, with Anna’s Archive saying that it prioritized tracks based on popularity. (Billboard first reported the Spotify scrape.)

The group, which says it “normally focuses on text” because “text has the highest information density,” claims it went after Spotify because it “discovered a way to scrape Spotify at scale” and “saw a role for us here to build a music archive primarily aimed at preservation.” 

With the release of Spotify’s music files and metadata, “anyone can now, in theory,” create their own personal free version of Spotify,” wrote Yoav Zimmerman, the CEO of AI startup Third Chair, in a LinkedIn post. “The only real barriers are copyright law and fear of enforcement.”

Aside from individuals spinning up their own Spotify instances, the data breach could also be used by unscrupulous AI organizations to “train on modern music at scale,” Zimmerman continued. 

Updated shortly after publication with a comment from Spotify.