Researchers found unsecured Elasticsearch database containing over 380 million records. Database contained login credentials and other data belonging to Spotify users. Spotify has not yet enabled any kind of multi-factor authentication that we know of. Many of the database records also contained personally identifiable information (PII) The PII could also be used for spear phishing or identity theft. Spotify users need to change their passwords to avoid being targeted by the fraudsters’ database. Users affected should have received an automated password reset.”]