The hacking of 99,6% of Spotify's music: what really happened

Universal Adventure » General » The hacking of 99,6% of Spotify's music: what really happened

Spotify 's music catalog , one of the streaming industry's greatest assets , has been embroiled in an unprecedented security incident. A group of digital archivists claims to have downloaded virtually all the music available on the platform, setting off alarm bells throughout the industry.

According to this group, known as Anna's Archive , the attack allowed the copying of 99,6% of Spotify's music catalog . The Swedish company, headquartered in Stockholm and with hundreds of millions of active users worldwide—including Spain and the rest of Europe—acknowledges that unauthorized access occurred , although it is currently avoiding confirming the exact extent of the theft.

Who is Anna's Archive and what does it claim to have done?

Anna's Archive defines itself as a non-profit, open-source digital library focused on collecting and preserving content such as books, academic articles, and other documents, many of which are copyrighted. They now claim to have scaled up by focusing on streaming music and targeting Spotify directly.

In a statement published on their blog, the group claims to have archived metadata for 256 million tracks and audio files for 86 million songs . According to their account, these figures represent approximately 99,6% of the music content currently offered by the platform.

The complete archive, they add, would occupy less than 300 TB and would be distributed through what they describe as " massive torrents ." These packages would group the content based on song popularity , according to Spotify's own internal metrics, making it easier to prioritize the most listened-to tracks.

Anna's Archive presents the result of this operation as the world's "first fully open music preservation archive ." The idea, they say, is that anyone can download this content to their computer, mobile phone, or tablet as part of a supposed mission to preserve knowledge and culture for future generations.

The group insists that this type of initiative would also allow for the safeguarding of music by lesser-known artists , not just that of major stars. While acknowledging that Spotify “doesn’t have all the music in the world,” they believe this massive data dump represents “a great start” to the preservation project.

How the hacking of 99,6% of the music was carried out

According to Anna's Archive, the group had previously discovered a way to extract data from Spotify on a large scale . They allegedly used scraping techniques , an automated method that uses software and bots to collect information from websites and online services and transform it into structured data.

In this case, this automation would have allowed the collection of millions of public metadata associated with each track—such as song name, artist, album, duration, or internal identifiers—and, according to the collective, the downloading of the audio files themselves in massive quantities.

The Swedish company, in communications sent to media outlets such as EFE or Android Authority, has confirmed that its investigation into what happened detected an “unauthorized access” in which a third party extracted public metadata and used “illicit tactics to circumvent Digital Rights Management (DRM)” , accessing “some audio files” on the platform.

This type of DRM bypass involves circumventing the protection mechanisms that prevent unauthorized copying and redistribution of content. Although Spotify has not detailed the specific vulnerability, the description points to a sustained attack, supported by accounts controlled by the group.

Company sources indicate that malicious user accounts that may have participated in the extraction have already been identified and deactivated , and that internal controls have been strengthened to detect suspicious usage patterns, such as automated replays or download volumes inconsistent with normal behavior.

Spotify's official position and the scope of the incident

Spotify, which boasts over 600-700 million users across both free and paid accounts worldwide, has confirmed the attack but remains cautious about disclosing figures. The company emphasizes that, for the moment, it can only confirm that public metadata was collected and that access was gained to “some of the audio files ,” without officially verifying that the copying reached 99,6% of the catalog, as Anna's Archive maintains.

From its headquarters in Stockholm, the platform emphasizes that the entire library is not believed to be compromised and that "the incident remains under investigation." The company also stresses that, according to available information, there is no evidence that the stolen files have been widely published or sold to date.

Another relevant point is the potential impact on users. Spotify has not reported any leaks of personal data or compromises to account information, which would suggest an attack focused on the music catalog and its metadata, rather than on credentials or sensitive customer information in Spain, Europe, or other regions.

Even so, the company acknowledges that the incident represents a symbolic and strategic blow , since the value of services like Spotify lies largely in how they structure, protect, and commercially exploit their catalog. The massive theft of songs also calls into question the robustness of their protection systems and their ability to stop highly persistent attacks.

In its official communications, Spotify has left the door open to possible legal action against those responsible, once the technical investigation is completed to accurately determine the origin of the attack, the actual volume of files copied, and the jurisdictions involved.

Cultural preservation, digital activism, and legal boundaries

Anna's Archive maintains that its main objective is "to build a music archive focused on preservation ." The group links this operation to its previous work in the field of digital books and other texts, where it already amasses vast collections of works, many of them uploaded and shared without the permission of authors or publishers.

In their messages, the group asserts that with the community's help , "humanity's musical heritage will be protected forever" against natural disasters, wars, budget cuts, or platform closures. They thus frame the hacking of 99,6% of Spotify's music as a form of cultural activism , rather than an act of piracy for commercial gain.

However, the legal framework is clear both in Spain and the rest of Europe: songs hosted on Spotify are subject to strict intellectual property regulations , which affect record labels, music publishers, artists, and the platform itself. The mass copying and distribution of these files without authorization constitutes a violation of copyright law and Spotify's own terms of service.

The tension between digital preservation and respect for rights had already manifested itself in other online library projects, such as LibGen or repositories of books and scientific articles. In this context, Anna's Archive's move into music could reignite debates in Europe about the leeway projects claiming to pursue a cultural or academic interest have when using copyrighted works without permission.

In the specific case of the Spotify hack, the preservation discourse clashes head-on with the fact that, if the file ends up circulating openly on the Internet, it would facilitate large-scale piracy , including content from independent artists, small labels, and European creators who depend on streaming revenue.

Potential impact: piracy, Spotify clones, and artificial intelligence

The scale of the leak attributed to Anna's Archive— 86 million audio files and 256 million records —opens the door to numerous unauthorized uses. Technology experts point out that a database of this magnitude could be used to create clone music streaming services or to feed artificial intelligence models trained on real recordings.

Figures in the field of generative AI, such as composer and copyright advocate Ed Newton-Rex , have warned that training AI systems with pirated material is a widespread, albeit controversial, practice in the tech industry. A nearly complete archive of Spotify's catalog would be especially valuable to those who want to develop music generation models capable of imitating styles, voices, or rhythmic patterns.

Other experts, such as Yoav Zimmerman , co-founder of Third Chair, point out that with such an extensive collection, it would be technically possible to create free, home-based versions of music platforms, independent of agreements with record labels and collecting societies. This perspective, however, runs headlong into copyright law and the risk of financial and criminal penalties.

The history of similar projects also shows that these large repositories often become data sources for major technology companies . Recent litigation in the United States has mentioned how companies like Meta allegedly used collections of pirated books, originating from initiatives like LibGen, to train AI models, leading to lawsuits and controversies regarding the fair use of copyrighted works.

Applied to the case of Spotify, the hacking of 99,6% of its music not only raises a traditional piracy problem , but also reopens the debate about the extent to which the technology industry is relying on unauthorized catalogs to develop artificial intelligence tools that then compete, in a way, with the creators themselves.

The alleged hacking of 99,6% of Spotify's music has brought several key issues to the forefront: the vulnerability of major platforms to persistent attacks , the limits of digital activism when legal boundaries are crossed, and the role these enormous volumes of data can play in areas such as piracy and artificial intelligence. While Spotify continues to investigate the true extent of the incident and assesses its next steps, the case has already become a prime example of how technology, culture, and copyright are once again clashing in the streaming era.