Tell me about your data breach

This is even more -stupid- (sorry, can not find a better word). By not communicating and re-assuring your users, your customers, you are building fear and anxiety and diminishing trust. You do not show you are in control.

Beside, I am not sure how much what you say should be taken for granted. I have, myself, worked with the CNIL as well, they do not recommend or tell you what to do (pro active). They evaluate what you have done and if it was enough (reactive).

I think you made, at least a big communication mistake.

Learning this from security monitoring site such as HaveIBeenPwnd makes you look like clueless and careless about your own users and data.

I stand to my initial statement. If, when, I receive an answer from the support about this and it is not satisfying, I will fill a complain with the CNIL and I would recommend the same to anyone who is not sure about the way you have handle this incident. If it can not change what happened and how you handled the incident anymore, it may prevent Deezer from doing the same type of mistake again.

The whole purpose of GDPR is to let user deal with their data and keep them in control. You patonize your customer and told them they do not need to know… which, by the way, is interetsing as your communication suggested to change your passwrod...don’t you think, then, this should have been sent to said users ??

Let’s be serious.

@Jaime. thank you for bringing what appears to be an “official” perspective to this discussion.

What your message describes is a compliance-focused security program, which is the bottom of the barrel. Working with compliance agencies to find out what, as you say above, they require that Deezer must do at some point in the increasingly distant future for something that happened in the distant past. A hallmark of this approach is for customers to see communications that originated in Legal or Communications, not Security. That communication, whenever it gets here, likely will check all the compliance boxes. And, like your message or the one already posted in Support, will leave your customers questioning at best, seething - or gone, like me! - at worst.

A better alternative at this point is to pose the “how should this best be handled” question to your Security team (you have one, right?), and, if they have been properly funded and trained, to follow their recommendation.

Yeah, I’ve just started receiving pharmacy spam from “Canada RX”. I know it is from this breach as the email is a unique (random) email address. How about not giving your user’s data to 3rd parties Deezer?

I just got an alert that Deezer had a data breach and my info was found on the dark web. 1/20/2023

Yea, Deezer botched the communication. They damaged their credibility with how they report to customers. So people are right to worry about “what about the next breach?”

But as a practical matter, I’m not so worried about the breach itself.

It happened in 2019, three or four years ago. The “horse was long out of the barn” when they discovered it in November 2022. See what I mean? Yea, they should have reported it within 72 hours. Absolutely they should have. But I don’t think it would have made any difference if they had, not with regard to the stolen data. Too late for that.  

(I even wonder if there are any provisions or practices for long ago breaches. It could make some sense, as in, don’t get everyone in a tizzy if nothing can be done. Besides, in my mind, isn’t it normal for people to update their password regularly? And if you don’t, now you have a reason to do so. 

We'll see what happens. 

I setup my deezer account with a unique email address which is only used for deezer.

Today I am getting spam from Brand Medicals-Express on that email address.

Has there been another data breach?

I will change my deezer registered email address and kill the existing as a precaution.

https://support.deezer.com/hc/en-gb/articles/7726141292317-Third-Party-Data-Breach

There has not been another breach since, no