According to the filing, it seems that this security issue, whatever it might have been, “may have included email address, your preferred display name, password, gender, and date of birth only to certain business partners of Spotify.” The company says that they have since conducted their own internal investigation and have informed all their business partners accordingly.
Spotify spokesperson Adam Grossberg claims that only a “small subset” of Spotify users are affected by this, but did not dive into specifics. Given that the company plays home to 320 million users, “small” would be relative. This is also not the first time the company has been forced to reset the passwords of its users.
Back in November, the company had also begun a rolling reset of user passwords after it was discovered that there was an unsecured database online containing around 300,000 stolen passwords.