A pirate activist group extracted Spotify’s entire music catalog and released approximately 300 terabytes of audio files and metadata across peer-to-peer networks. Anna’s Archive documented the leak on Thursday, covering 86 million audio files and 256 million rows of track metadata that represent roughly 99.6 percent of all listening activity on the platform.
Spotify conducted an investigation into the unauthorized access. A spokesperson told Billboard, “An investigation into unauthorized access identified that a third party scraped public metadata and used illicit tactics to circumvent DRM to access some of the platform’s audio files. We are actively investigating and mitigating the incident.” This response outlines the method of the breach, which involved combining publicly available data with techniques to bypass digital rights management protections.
Anna’s Archive, an organization that typically preserves books and academic papers, described the release as a “preservation archive” for music. The group stated that the effort aligns with its mission of preserving humanity’s knowledge and culture. The collection surpasses previous efforts significantly, containing 37 times more unique recordings than MusicBrainz, the prior largest open-source music database with approximately 5 million unique International Standard Recording Codes, or ISRCs.
The leaked metadata covers an estimated 99.9 percent of Spotify’s 256 million tracks and includes 186 million unique ISRCs. Anna’s Archive prioritized the files using Spotify’s own popularity metric and captured songs available through July 2025. This prioritization ensures that the most streamed tracks appear first in the distribution process.
The group is releasing the data in stages to manage the volume. Metadata has already become available for download, while the music files are being distributed in order of popularity across peer-to-peer networks. This staged approach allows for broader dissemination without overwhelming initial servers.
Yoav Zimmerman, CEO and co-founder of Third Chair, a startup that develops legal tools for media companies, commented on the accessibility of the leaked data. In a LinkedIn post, he wrote, “Anyone can now, in theory, create their own personal free version of Spotify (all music up to 2025) with enough storage and a personal media streaming server like Plex. The only real barriers are copyright law and fear of enforcement.” Zimmerman emphasized that the data is already circulating on peer-to-peer networks and added, “There is no putting this back in Pandora’s box.”
Zimmerman also addressed broader applications of the leak. He observed that the breach makes it dramatically easier for AI companies to train models on modern music at scale, with copyright law and the deterrent of enforcement serving as the primary obstacles.
A Spotify spokesperson said in an emailed statement: “Spotify has identified and disabled user accounts engaged in unlawful scraping. We have implemented new safeguards against copyright-infringing activity and are actively monitoring for suspicious behavior. Since day one, we have stood with the artist community against piracy and continue to work with our industry partners to protect creators and defend their rights.”
