Once there was a petition requesting for 2FA - wonder how many signed? Just 30 people.
https://www.change.org/p/spotify-implement-2-factor-authentication
Last November there was a database on the Dark Web containing over 380 million individual records, including login credentials that were leveraged for breaking into 300,000 to 350,000 Spotify accounts - Credential Stuffing.
The exposed records included a variety of sensitive information such as people’s usernames and passwords, email addresses, and countries of residence.
As a response Spotify did force a reset on these suspect accounts.