Podcasters beware: a post on a popular hacking forum claims to have leaked 14,000 records of account usernames, emails and passwords from Spotify's recently acquired podcasting platform, Anchor.

Previously the world's largest podcast hosting platform, Anchor, was acquired by Spotify in 2019 and combined with Spotify for Podcasters in March 2023.

The merge served to create a one-stop shop for podcasters, enabling users to carry over their existing Anchor login for a comprehensive suite of podcast creation, management and distribution features.

However, less than a month later, a post on popular hacking forum LeakBase claims to have leaked nearly 14,000 records of user credentials – potentially exposing recently merged accounts to be compromised.

The post links to an alleged data leak file, seen by Information Age, which contains information for droves of user accounts in a no-fuss email-and-password text format.

The details were leaked in a notably scant forum listing, containing only a link to a plain-text file alleging to be stolen data and offering no indication on how exactly the purported user information was stolen or compromised.

Coming from the now acquired platform, many Anchor credentials can still be used to access Spotify for Podcasters, meaning bad actors could potentially access active Spotify for Podcasters accounts and the array of sensitive information locatable within, including; podcast analytics, unpublished episodes, financial earnings, and contact information such as name, phone number, date of birth and address.

As is the case for most cases of account compromise, the alleged data leak also carries a significant threat for podcasters who re-use their credentials across other, unrelated platforms.

At the time of writing, Spotify has not publicly addressed the purported data leak.

Spotify did not respond to Information Age's request for comment.

LeakBase threat gaining traction

The alleged data leak was shared on LeakBase, a primarily Russian-language forum launched in 2021 for the purpose of hack-related services and data listings.

LeakBase has gained rapid popularity among hacking communities, accruing ample users following the closure of BreachForums – a once-leading hacker forum tied to the landmark 2022 data breach at Optus.

BreachForums went blank after the US Federal Bureau of Investigation(FBI) arrested its alleged operator, causing droves of users to migrate to burgeoning platforms such as LeakBase.

Hosted on the clear web and free for new users to join, the platform accrues and shares leaked databases and private data – as well as sections for news and tips on hacking, social engineering, penetration and other security-related topics.

While nowhere near as lucrative as BreachedForums in its prime, LeakBase has already listed details for countless data leaks since its early-year foundation, including alleged posts for Uber, Adobe and LinkedIn.

Users of the platform congregate on a highly active channel via encrypted messaging service Telegram, where updates on new leaks are pushed out on a near daily basis.

On the forum posting for Anchor, users expressed passing gratitude at alleged data dump, posting "thank you for the share kind sir" and "nice, thanks for that" under a link to nearly 14,000 records.

If you are concerned your podcasting account could be compromised, conventional advice is to perform a password reset and ensure passwords are unique across different platforms.