Spotify investigates data breach, after pirate group claims it ‘scraped’ its music library

Streaming platform Spotify confirmed on Monday its library had been scraped by a third party, after a pirate activist group claimed it released metadata for the platform’s entire music catalogue.

According to a blog post on the open source search engine Anna’s Archive, the release includes metadata for 256 million tracks and 86 million audio files, representing around 99.6 percent of listens.

The files cover music that was put on the platform between 2007 and 2025, the blog post said.

“It’s the world’s first ‘preservation archive’ for music which is fully open (meaning it can easily be mirrored by anyone with enough disk space),” the blog post stated.

A spokesperson from Spotify confirmed the unauthorised access of its library, adding that the third party “used illicit tactics to circumvent DRM (digital rights management) to access some of the platform’s audio files”.

“Spotify has identified and disabled the nefarious user accounts that engaged in unlawful scraping. We’ve implemented new safeguards for these types of anti-copyright attacks and are actively monitoring for suspicious behaviour,” the spokesperson later added in a statement to Euronews Next.

The spokesperson said there is no indication of any non-public user information being compromised in the breach, and that the only user-related data involved relates to public playlists created by users.

Spotify did not specify how much data was scraped. Hackers said the data was “a little under 300TB in total size” and would be distributed on peer-to-peer file-sharing networks in bulk torrents.

Anna’s Archive claims its mission is “preserving humanity’s knowledge and culture”. The search engine for “shadow libraries” has until now been focused on books and other texts.

“This Spotify scrape is our humble attempt to start such a ‘preservation archive’ for music,” the blog post states. “Of course Spotify doesn’t have all the music in the world, but it’s a great start.”

Theoretically, anyone with the technical knowledge and disk space could use the archive to create their own copy of Spotify. Realistically, anyone who tries will face swift and severe legal action from record companies and other rightsholders.

One of the bigger concerns is the potential for artificial intelligence (AI) companies to use the data to train their models, according to Yoav Zimmerman, CEO of Third Chair, a company that tracks unauthorised use of intellectual property.

“It also just became dramatically easier for AI companies to train on modern music at scale,” Zimmerman said in a LinkedIn post. “The only thing stopping them is copyright law and the deterrent of enforcement.”

Spotify said it is actively working with industry partners to protect the rights of the creative community.

“Since day one, we have stood with the artist community against piracy,” the company shared in a statement.