Mysterious musicians with names like Bergenulo Five, Bratte Night and DJ Bruej have been appearing on Spotify, racking up thousands of streams and prompting users to suspect their accounts were hacked. These artists produce short, lyric-less songs with generic cover art and have no presence elsewhere on the internet, lacking fan pages, social media accounts or concert listings.
Listeners reported finding these tracks in their listening history without ever searching for or playing them. Despite Spotify denying that accounts have been hacked, the company has not explained how these playlists came to include the unknown artists. After the BBC requested contact details for the artists, many of them disappeared from the platform within days.
Cybersecurity graduate Callum Dixon, who wrote a thesis on Spotify, suggested that access tokens – permissions granted when logging into one site via another – could be involved. He referenced a Facebook security breach in September 2018 that exposed up to 50 million accounts and potentially compromised access tokens used for third-party logins, including Spotify.
Facebook stated that all affected tokens were cancelled and that there was no evidence the attackers used them to access other sites. However, security expert Tim Mackey of Black Duck noted that identifying all breached tokens is complex and some could have been missed. Other experts pointed to issues with users reusing passwords across different platforms.
The phenomenon, dubbed “mysterycore” by some, began appearing on Spotify in early October 2018, shortly after the Facebook breach was made public. Many users only noticed the unauthorised streams later. The mystery remains as to how these artists gained such exposure without direct user action.
