Deezer data breach (2019)

In November 2022, a sprawling dataset of Deezer user records surfaced on a hacking forum — but the data itself dated to 2019, having been retained by a former third-party partner long after it should have been destroyed. The leak ultimately exposed roughly 229 million records.

What happened

The Paris-based music-streaming service Deezer had shared user data with a third-party service provider as part of normal operations around 2019. Deezer ended that relationship in 2020, and under the terms of their contract the provider was obligated to destroy the data it held.

Instead, the provider retained a 2019 snapshot of Deezer's user base. On 6 November 2022, a user of a well-known breach forum posted a roughly 60 GB CSV file containing 257,829,454 records drawn from this snapshot. Deezer later confirmed the incident was a third-party breach, emphasizing that its own infrastructure had not been compromised and that the provider had breached its contractual obligations by keeping the data.

Data exposed

Because the records came from a 2019 snapshot, the exposed fields reflected the profile data Deezer held at that time:

• Email addresses
• First and last names
• Dates of birth
• Gender
• Location data (city and country)
• User ID and account registration date

Crucially, Deezer stated that no passwords and no payment information were included in the dataset. When the breach was loaded into Have I Been Pwned, it was de-duplicated to 229,037,936 unique email addresses.

Impact

Even without credentials or financial data, the combination of name, email, date of birth, and location is highly useful for targeted phishing, identity-correlation, and social-engineering campaigns. The breach drew scrutiny under the EU's GDPR, given Deezer's status as a French company and the volume of European users affected. Deezer notified regulators and affected users and reiterated that its core systems remained secure.

Why it matters

The Deezer incident is a textbook third-party / supply-chain data exposure: the breach did not originate inside Deezer's own environment but with a vendor that failed to delete data after the engagement ended. It underscores that data-protection obligations do not stop at a company's perimeter — contractual data-destruction clauses are only as good as the partner's compliance, and a single non-compliant vendor can produce a nine-figure breach years after the business relationship ends. It is a recurring lesson for any organization that shares personal data with processors and subcontractors.