Spotify, the largest music streaming platform in the world with hundreds of millions of active users, has been hacked by Anna's Archive, a group that labels itself as archivists. The shadow library has allegedly scraped nearly the entirety of the platform, downloading roughly 300 TB of music and metadata that is now being distributed illegally via torrents.

Spotify has acknowledged the attack and issued a statement to Android Authority: "An investigation into unauthorized access identified that a third party scraped public metadata and used illicit tactics to circumvent DRM to access some of the platform's audio files. We are actively investigating the incident."

The leaked collection consists of around 86 million files, representing ~37% of all music available on the platform (but 99.9% of listens). Most of them are preserved in Spotify's original OGG Vorbis 160 kbps format, but if any song has a popularity rating of exactly 0, then they've been re-encoded to 75kpbs to save space.

The group has also compiled 256 million rows of metadata that accounts for 99.6% of all listens on Spotify and it has been compiled into query-able SQL databases. The group has done a near-lossless JSON reconstruction of Spotify's API, including 186 million unique ISRCs (identifiers for individual recordings worldwide).

The metadata includes album info, artist info, cover art, etc., and is included in the torrent files. The blog post released by Anna's Archive going over this leak is surprisingly informative, including a bunch of charts that break down how Spotify treats music in general.

According to the group, the reason for this large-scale hack is preservation of music. They argue that Spotify's collection is too overtly focused on popular artists and sound quality, and that there needs to be an "authoritative list of torrents aiming to represent all music ever produced."

The torrents are self-hosted, and the files are packaged using Anna’s Archive Containers (AAC), a custom format the group has used for years. The metadata has already been released while the rest of the data will follow a staggered release pattern in huge chunks, categorized by popularity.

Spotify has taken steps to address the issue, stating that they have identified and disabled the nefarious user accounts that engaged in unlawful scraping. They also claim to have implemented new safeguards for these types of anti-copyright attacks and are actively monitoring for suspicious behavior.