Hacktivist group Anna’s Archive claims to have scraped almost Spotify’s entire catalog and is now sharing it through BitTorrent, creating a roughly 300 TB “preservation archive.”

On their blog, the group said:

“A while ago, we discovered a way to scrape Spotify at scale. We saw a role for us here to build a music archive primarily aimed at preservation.”

Spotify confirmed that no user data was accessed, but the incident underscores how large-scale scraping, DRM circumvention, and weak abuse controls make major content platforms high-value targets.

Anna’s Archive reportedly collected metadata for around 256 million tracks and audio files for approximately 86 million songs, totaling nearly 300 TB. This represents about 99.9% of Spotify’s catalog and 99.6% of all streams.

Spotify says it has “identified and disabled the nefarious user accounts that engaged in unlawful scraping” and implemented new safeguards.

From a security perspective, this case shows how scraping can escalate from metadata access to industrial-scale content theft. By exploiting public APIs, abusing tokens, evading rate limits, and bypassing DRM, attackers can extract protected content if enough accounts are compromised and appear legitimate.

While this will likely be framed as a copyright issue, it’s also a security warning: if a platform exposes content or metadata at scale, someone will automate access, weaponize it, and redistribute it. Relying solely on terms-of-service violations is not an effective security measure.

How this affects you

Currently, there’s no evidence that passwords, payment info, or private playlists were exposed—this incident concerns only content and metadata. However, scammers may try to exploit the situation, so be cautious of messages claiming your account was compromised.

Spotify Security Tips:

• Change your Spotify password if it’s reused elsewhere or shared.

• Regularly review active sessions and sign out of any you don’t recognize (Account > Settings > Privacy > Sign out of all devices).

• Avoid unofficial downloaders, converters, or “Spotify mods” that ask for your login or broad permissions—they can steal credentials or rely on the same scraping techniques.

Stay safe online: Protect your accounts and personal data using reliable tools like Malwarebytes Identity Theft Protection.