Tell me about your data breach

Hey @barbless 

Since the beginning of November 2022, this message can be found on deezer's support pages:

https://support.deezer.com/hc/en-gb/articles/7726141292317-Third-Party-Data-Breach

Unfortunately, I can't tell you why no info mail was sent.

Thanks @dee_dirk ! Wouldn’t have noticed this, since it’s labeled Third Party.

Just saying, it is disappointing that Deezer is taking this tack - labeling it as a third party problem and doing almost nothing to alert their customers. After all, it is their data from their customers. The way to alert customers is not to hide an article about a breach in Support pages, it is to actually contact all the users.

It’s laughable that they “are actively working to take appropriate action to safeguard the breached data.” The data is breached and being sold - it’s no longer in their control.

It’s distressing that they failed to identify all of the specifics about the breached data. They say “basic information such as first and last names, date of birth, and your email address”. But actually it includes those fields and: gender, location data (City and Country), join date, and User ID. All of those fields can be used to craft a very convincing targeted phishing message.

And despite their attempt to portray this as someone else’s fault, it is actually their fault since they evidently failed to properly manage their third-party relationship. (Meaning, their contract ought to have required the third-party delete Deezer’s data when the contract was ended.)

I fully agree with @barbless. Did you try to request anything from their customer service directly?

i also feel so disappointed, such amateur move from their side that its really annoying treating users like that 

Hello,

I have also just been alerted about that, since I got email from Firefox Monitor.

Is it something new that we are not aware of? I assume there should be very rigid reaction from Deezer asap.

Nash they won't do a thing about it, some message got hidden in the bowls of the Deezer archives and they're happy to wash their hands of it and carry on trying to rinse their customers for everything they can get.

This is the email I received

Hello,

I have also just been alerted about that, since I got email from Firefox Monitor.

Is it something new that we are not aware of? I assume there should be very rigid reaction from Deezer asap.

 

 

This is the email I received

I received an email and just like @djlevan I was expecting somewhere something from Deezer on this but nothing. 
I asked them on Tweeter account, no reply. 

Worrying as that if a data breach is detected as per GDPR (and irrespective of who owns the company if a user is in the EU/UK Deezer has to abide by these laws) the LAW states under Article 33 GDPR :

“In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it “

I received no notification from Deezer and like others received a notification from Firefox

If they had a third party they shared the data with and this was compromised Deezer still, under Article 33, has a legal requirement to let people know.

I would like to know why we weren’t told of a breach - even if it’s third party if it involves data Deezer holds or processes they are legally bound to inform those affected

To find out of a breach in 2019 through a separate service is a clear breach of the law. Why did Deezer think they could not inform us and break international law in multiple countries?

@katy8439 Totally aligned with you.

They are the data processor and should take care of their processors. Then should have warned the data subject.

It is higly worrying that they did not feel necessary to inform us.

I have asked them to justify the reason for deciding to not let the data subject been informed. Depending on their answer, I will raise the concern to the CNIL, unless I am mistaklen, this is the authority they are depending from.

https://www.cnil.fr/fr/agir

To be used once you tried to contact Deezer and they fail to answer or their answer is not satisfying enough to you.

I can not believe that I have been informed of this by HaveIbeenpwnd or Firefox monitor (which I thank for that)