Deezer deezer.com Deezer data breach: what happened and what to do
In late 2022, music streaming service Deezer disclosed a breach that traced back to a 2019 backup exposed by a third-party partner. Have I Been Pwned lists 229,037,936 accounts, with emails, names, birth dates and locations. Passwords and payment details weren't included.
View all 13,115 breaches- Breach date
- 22 Apr 2019
- Affected
- 229,037,936
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names, Spoken languages, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Deezer, a music streaming service, disclosed a data breach in late 2022 that Have I Been Pwned says impacted over 240 million customers. The data dated back to a mid-2019 backup exposed by a third-party partner. It was later sold and then widely redistributed. Deezer said the data came to light on November 8, 2022, and that the partner involved was one it had stopped working with in 2020. It said its own databases were secure.
Have I Been Pwned lists 229,037,936 unique email addresses. The exposed data includes email addresses, IP addresses, names, usernames, genders, dates of birth, spoken languages and geographic locations. According to Deezer, no passwords or payment details were compromised.
With no passwords in the data, the main risk is phishing. A scammer who knows your name, email, birth date and rough location can write a message that looks like it's from Deezer or a bank. Your date of birth also can't be changed, so be wary of anyone who quotes it back to you.
Deezer's disclosure was reported to cover over 240 million customers, while Have I Been Pwned lists 229 million unique email addresses. Use Have I Been Pwned's figure as the confirmed count.
What to do if you were in it
- 1
Treat unexpected emails and texts with suspicion
Criminals use breach details to make scam messages sound real. If a message mentions the breach or asks you to log in, click a link or share a code, go to the company's site yourself instead.
- 2
Be careful with your date of birth
It can't be changed, so ignore calls or emails that quote it to seem legitimate, and keep an eye out for it being used to verify someone as you.
- 3
Use a unique password and 2FA
Deezer said passwords weren't exposed, but a unique password per site and two-factor authentication limit the damage of any future breach.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in breach databases and the dark web and tells you what to do about each hit. Serus can't pull breach data back, but it alerts you when your details turn up.
Frequently asked
Was I affected by the Deezer breach?
Have I Been Pwned lists about 229 million unique email addresses. Search yours there or run a free Serus scan.
What was exposed in the Deezer breach?
Email addresses, IP addresses, names, usernames, genders, dates of birth, spoken languages and geographic locations. Deezer said passwords and payment details weren't compromised.
Should I change my password?
Deezer said passwords weren't exposed. Changing yours is still a cheap precaution, especially if you reuse it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
