DistroKid Put the Song on a Band's Page Without the Band

On 10 September 2026 Riding High appeared on Lathe of Heaven's Spotify as if the band had released it. The person who uploaded the file had never been in the band, and had not asked them.

That is not a glitch that happened to one listing. A distributor that will write to a catalogue because someone typed the name governs anyone whose living sits on those pages. Almost none of the mechanism is specific to Lathe of Heaven, or to the generator that made the track.

What typing the name actually does

The journalist who ran the test did not break into an account. He bought a month of DistroKid and entered the band as the artist. The stores where they already lived came back as a match he could claim.

A verified page is supposed to mean that the name and the files share an owner. The form does not test that. It asks the uploader to confirm it, and it treats a yes as enough to write there.

The login was never asked for. The name was enough.

Nothing in that sequence required a manager, a stolen password, or a person already inside the band. It required a string the stores already recognised, and a confirmation ticked by the person who wanted the listing.

Nine days later the same Spotify page still listed the records the band had released, and did not list the test. The date that file came down was not on any page opened for this piece.

A file can be taken off a page, and the form that accepted the name does not come down with it. The next typed string still goes through the same door.

What the lock is supposed to be

DistroKid's help pages already name a line the test just walked across. A generator may be used, and a person may not be copied. The test and that page are not arguing about whether the tool is permitted. They are arguing about whether a checkbox is what stops a stranger using a name.

The same help pages have a language for when catalogues collide. Similar names get grouped, and the owner files a correction. That is a description of two honest listings that got filed together. It is not a description of a person who typed the exact name and was offered the existing pages as a match.

Spotify publishes a tool that looks, from a distance, like the missing lock. What it actually does with silence is the part that matters, and the part the blog is willing to print. The post that describes it was updated the day before Riding High appeared.

That is Spotify's own page, not a paraphrase of coverage. It does not say the tool was on for Lathe of Heaven. It says what inaction does when the tool is on. Silence still publishes.

The login was never asked for. The name was enough.

Who published that it landed

Coverage of the September test names a band and moves on. Three people had already published, on pages they run, that a song or album they did not make appeared under their name, or that they had found such attachments on other artists' pages. What follows is the string each of them actually posted, rather than a catalogue assumed from a handle.

Emily Portman put the event on her own site in December. What she published next was not a demand that a platform invent a lock. It was a turn toward the record she did write.

When she went looking, the files were on the storefronts she already used. They were not sitting on a stranger's page that happened to share a spelling. The stores did not move together: one came down quickly, and the others took much longer. The sentence she offered afterwards was about whether a name on a page can be believed.

Spotify's account to the BBC treats those albums as a filing error between two people who share a name, corrected once it was flagged. The credits on the files named her as the person who made them. Those are not two versions of one clerical mistake. They are an argument about whether a same-name collision and an impersonation of a catalogue are the same event.

Mix-up is a comforting word. It describes two honest catalogues that got filed together. A checkbox ticked by a stranger is not a collision. DistroKid's correction form already speaks in the first register. The September test happened in the second.

Murphy Campbell's version arrived as a statement, in January, on a reel she published herself. The object she named was not a neighbour with the same spelling. It was her voice, on the major platforms, in files she did not upload.

The Verge, writing in April, put a date on the discovery and a remainder on a duplicate listing. Both objects can sit at once: an impersonation of a person, and a leftover under the same spelling. Spotify's mix-up sentence describes the second. It does not retire the first.

Odette Child, posting as a duo in July, were not writing about a hijack of their own catalogue. The first reel is the discovery, stated as something that would sound implausible if they had not just watched it happen.

The next day's post is the scale, not the anecdote. The people they were trying to warn had not, as far as they could tell, been reached. What was coming back already pointed at a larger theft than one reel could hold. Those people are not in the coverage of Riding High. They are the population the form actually governs.

By the last of those posts the range is visible. Someone whose own albums were written onto her catalogue, someone whose voice was the object with a leftover on a duplicate name, and someone counting other people's pages because those people had not been reached. None of that is information a verified badge carries.

Why this is not only those three pages

It would be easy to file Riding High as an AI-music story and stop, which misses what the form actually reads. It reads a name. Anyone whose living is a catalogue a distributor can address that way is inside the same instruction, including people who never wrote a sentence about it.

Spotify already has a rule about generated identities. That rule looks at whether the public face is a person. It does not look at a track attached to a human being's page. The track, in that rule, is beside the point. Here the track is the point, because the page it landed on already belonged to someone.

On 15 September, in the same week as the upload, Universal sued DistroKid in Delaware. The complaint is about volume and about money taken from rightsholders. A footnote carves out generated music that is disclosed as generated. That is not a finding about Riding High. It is an adjacent case about a different object, filed five days after the test.

The complaint is a case about quantity and recordings. The form that accepted Lathe of Heaven is still a checkbox. Those are not the same object.

A manager who wants the page still has to get inside the account. A distributor who accepts a typed name never does. The page looks like theirs because it is theirs. The catalogue is what was written to.

Why this is not only a story about small bands, or about DistroKid, or about a generator: any artist page that is addressed by a string can be built this way. Which tool made the file is not the part that travels. A name a distributor will accept can be typed from anywhere the form is open.

What is honestly available

This piece cannot say when the test single came down, or that Artist Profile Protection was switched on for that band. Spotify announced the tool. The upload still happened. Those two sentences do not make a third.

It cannot say what DistroKid will answer in court. No reply from the company sat on any page opened for this piece.

A verified artist page is not a lock. The locks on offer are a checkbox the other person ticks, an optional email that still publishes if nobody answers, and a form that treats the event as two people with similar names. None of those is a test the owner of the page can run from below.

Waiting for the official page to mean what it looks like is not a plan. The page will still look like theirs. That is what the form is for.