# Qobuz data breach? **URL:** \ **Category:** Qobuz\ **Created:** [May 15, 2025, 2:47am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481 "2025-05-15T02:47:13Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Miguel\_Rode](https://community.roonlabs.com/user_avatar/community.roonlabs.com/miguel_rode/32/116755_2.png) [@Miguel\_Rode](https://community.roonlabs.com/u/Miguel_Rode)\ **Post date:** [May 15, 2025, 2:47am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/1 "2025-05-15T02:47:14Z")
Today I was alerted by two different identity monitoring services that some of my personal information had been found on the Dark Web. One of the services allowed me to review the exposed data, which included my email address and, surprisingly, the leaked password as well. With this information I went to my password manager, to try and figure out which website was the one on which I was using that particular variation of my “typical” password (which I routinely change by adding special characters and numbers in different positions… I’m sure I’m not alone in that less-than-ideal practice 🙂). To my surprise, the only website that uses that password (out of the hundreds in my password manager) was Qobuz. Nothing on their website speaks of a security incident, so I’m not positive that they were hacked. Who knows. Maybe they were and aren’t even aware. I still thought it was worth it to alert this community. If you received a similar alert lately, or maybe even if you haven’t, you may want to change your password at Qobuz and also at any other sites where you may have used the same id/password combo. Be safe out there… ---
**Author:** ![Marian](https://community.roonlabs.com/letter_avatar/marian/32/5_5575768a8748004e209b776fc1b2916d.png) [@Marian](https://community.roonlabs.com/u/Marian)\ **Post date:** [May 15, 2025, 3:26am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/2 "2025-05-15T03:26:50Z")
> [@Miguel\_Rode](#): > > I was using that particular variation of my “typical” password (which I routinely change by adding special characters and numbers in different positions… I’m sure I’m not alone in that less-than-ideal practice Since you’re using a password manager, why not generate completely random passwords? ---
**Author:** ![MusicD](https://community.roonlabs.com/user_avatar/community.roonlabs.com/musicd/32/372347_2.png) [@MusicD](https://community.roonlabs.com/u/MusicD)\ **Post date:** [May 15, 2025, 5:34am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/3 "2025-05-15T05:34:57Z")
> [@Miguel\_Rode](#): > > Today I was alerted by two different identity monitoring services What services do you refer to? > [@Miguel\_Rode](#): > > If you received a similar alert lately Thinking this was an email, do you open all your emails without looking at who sent them and where they came from? ---
**Author:** ![Suedkiez](https://community.roonlabs.com/user_avatar/community.roonlabs.com/suedkiez/32/107321_2.png) [@Suedkiez](https://community.roonlabs.com/u/Suedkiez)\ **Post date:** [May 15, 2025, 7:19am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/4 "2025-05-15T07:19:38Z")
> [@MusicD](#): > > What services do you refer to? Not to preempt the OP, but there are various services who monitor leaked credentials like > **[Mozilla Monitor](https://monitor.mozilla.org/en)** > > Find out if you’ve been part of a data breach with ⁨Mozilla Monitor⁩. We’ll help you understand what to do next and continuously monitor for any new breaches. Usually included in password managers, like > **[Dark Web Monitoring - LastPass](https://www.lastpass.com/features/dark-web-monitoring)** > > Protect your data with LastPass Dark Web Monitoring. Get alerts if your information appears on the dark web and stay ahead of potential threats. ---
**Author:** ![anon77144803](https://community.roonlabs.com/letter_avatar/anon77144803/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon77144803](https://community.roonlabs.com/u/anon77144803)\ **Post date:** [May 15, 2025, 9:28am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/5 "2025-05-15T09:28:08Z")
Both Google and Apple password managers do the same monitoring. ---
**Author:** ![Daz\_Davies](https://community.roonlabs.com/user_avatar/community.roonlabs.com/daz_davies/32/329023_2.png) [@Daz\_Davies](https://community.roonlabs.com/u/Daz_Davies)\ **Post date:** [May 15, 2025, 9:50am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/6 "2025-05-15T09:50:39Z")
As mentioned, there a plenty of platforms that monitor for data breaches. You probably already have one if you have an Apple or Google phone or computer. Nord VPN also provides this service as part of its package. I’ve checked and I have no reports of a data breach from Qobuz on any of them. ---
**Author:** ![Vitor\_Goncalves](https://community.roonlabs.com/user_avatar/community.roonlabs.com/vitor_goncalves/32/269985_2.png) [@Vitor\_Goncalves](https://community.roonlabs.com/u/Vitor_Goncalves)\ **Post date:** [May 15, 2025, 10:44am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/7 "2025-05-15T10:44:36Z")
I received a similar message yesterday from a service I use and the email and password combination also led me to the Qobuz account. ---
**Author:** ![anonymouse](https://community.roonlabs.com/letter_avatar/anonymouse/32/5_5575768a8748004e209b776fc1b2916d.png) [@anonymouse](https://community.roonlabs.com/u/anonymouse)\ **Post date:** [May 16, 2025, 8:54am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/8 "2025-05-16T08:54:55Z")
I have identified that my email address (one used uniquely for Qobuz) was most likely stolen from Qobuz and acquired by another company. Telling this to Qobuz is a joke. I emailed the support address listed on their website’s privacy and data terms – a day later it bounced back with this spectacularly incompetent failure message: > 554 5.4.7 [internal] message timeout (exceeded max time, last transfail: 451 Temporarily unable to find 00D58000000JmCx at EU56 originalInstance eu16) The website then tells me to use the contact form available from the corner of the app. But the app has forcibly logged me out and gives an unexplained error message when I try to log in again. I got in to the app on a different machine. There is no contact form, just a chatbot. Entertaining promised response time from a chatbot: ![Screenshot 2025-05-16 at 10.03.17](https://roon-community-uploads.s3.amazonaws.com/original/4X/4/7/f/47f3a20c923242c9e8d3e1600fbf2eea4f96997f.png) Asking the chatbot for contact details gives this: > I apologize, but we don’t provide a direct email address for customer service. However, we do have a dedicated contact form for you to reach our team. You can find this by visiting our website and clicking on the “Help” or “Contact” link, usually at the bottom of the page. This will take you to our customer service contact options. Well that’s all very well, but the only thing the Help link does is send us back to the chatbot; and there is no Contact link. When I say I want to report a cybersecurity issue the chatbot then says, believe it or not, that I should send a LETTER by registered mail to their office in France. No thanks. It is seriously worrying that a company has no way to provide the data they need to diagnose a cyber issue. They are likely to be in breach of GDPR, I believe, by not notifying us (other than the generic message on the website which I do not think is sufficient). ---
**Author:** ![Miguel\_Rode](https://community.roonlabs.com/user_avatar/community.roonlabs.com/miguel_rode/32/116755_2.png) [@Miguel\_Rode](https://community.roonlabs.com/u/Miguel_Rode)\ **Post date:** [May 19, 2025, 2:38am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/9 "2025-05-19T02:38:37Z")
I do for some sites, typically the ones I access on my desktop computer where I have the password manager. For sites or apps that I use on my phone, I prefer passwords that are more easily typed/remembered. Probably less than ideal… ---
**Author:** ![Miguel\_Rode](https://community.roonlabs.com/user_avatar/community.roonlabs.com/miguel_rode/32/116755_2.png) [@Miguel\_Rode](https://community.roonlabs.com/u/Miguel_Rode)\ **Post date:** [May 19, 2025, 2:42am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/10 "2025-05-19T02:42:02Z")
@Suedkiez mentioned a few. The ones that I use are OnAlert ([portal.onalertid.com](http://portal.onalertid.com)) and Microsoft Defender. When they send an email alert, I log into their webpage and check the alerts on the sites. ---
**Author:** ![David\_Aronson](https://community.roonlabs.com/user_avatar/community.roonlabs.com/david_aronson/32/339677_2.png) [@David\_Aronson](https://community.roonlabs.com/u/David_Aronson)\ **Post date:** [May 19, 2025, 3:56am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/11 "2025-05-19T03:56:03Z")
I believe that there has been a security breach at Qobuz. Let me explain… I have been having a lot of issues with Qobuz lately. I believe that they have an active security breach. If you comb through the forums here, there are people talking about random Tracks, Albums and Artists showing up in their favorites. I’m talking about music that you KNOW you don’t like or listen to. Personally, I have deleted about 40k tracks and about 800 artists that I don’t listen to that were listed in my favorites in Qobuz. Of course, this muddies up my Roon statistics and favorites there too. Long story short, I use 1Password for about 12 years and generate random passwords for EACH of my websites. For Qobuz I had a 15 digit pass that included caps and lower-case as well as numbers and special characters. So my side of the firewall hasn’t been breached. Yes, I changed my password to 22 characters and have spent 8 hours or so cleaning up my account. It still hasn’t stopped but has slowed down. Qobuz has been slow to respond (probably because they had a lot of fires to put out), but I finally have them working with me. They are aware of the issues but aren’t admitting anything to me. If it makes you feel any better, my information (as well as my wife) has been on the black market for about 5 years now. It’s not because I have lazy passwords, it is because many companies have been hacked over the years, so a lot of us are already there in the black market. All you can really do is do as some have suggested here already…change your password, use a password manager with Radom/complex passwords, never click a link in your emails and lock your credit with the 3 agencies (I’m in the USA). Anyhow, I hope that helps. ---
**Author:** ![Marian](https://community.roonlabs.com/letter_avatar/marian/32/5_5575768a8748004e209b776fc1b2916d.png) [@Marian](https://community.roonlabs.com/u/Marian)\ **Post date:** [May 19, 2025, 5:33am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/12 "2025-05-19T05:33:25Z")
> [@Miguel\_Rode](#): > > For sites or apps that I use on my phone Don’t they have a mobile app also? It would be quite an omission if they didn’t. ---
**Author:** ![Suedkiez](https://community.roonlabs.com/user_avatar/community.roonlabs.com/suedkiez/32/107321_2.png) [@Suedkiez](https://community.roonlabs.com/u/Suedkiez)\ **Post date:** [May 19, 2025, 6:01am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/13 "2025-05-19T06:01:44Z")
> [@David\_Aronson](#): > > random Tracks, Albums and Artists showing up in their favorites. I’m talking about music that you KNOW you don’t like or listen to. There was a known issue with accounts being confused, which affected some Roon users, too, in March. > [@Qobuz albums issues, even 72 hours after fix](https://community.roonlabs.com/t/qobuz-albums-issues-even-72-hours-after-fix/294710): > > What’s happening? · Other How can we help? · None of the above Other options · Other Describe the issue My Roon library has suddenly been mysteriously populated by tons of albums that I never added, which look to outnumber the actual albums in my library. I use Qobuz via Roon (by way of Nucleus+), but checked Qobuz and my library there is correct. So the problem is not with Q but with Roon. Thanks! P.S. Roon has been sluggish lately while I'm at it. Describe your network setup Nucleus+ with … ---
**Author:** ![MusicD](https://community.roonlabs.com/user_avatar/community.roonlabs.com/musicd/32/372347_2.png) [@MusicD](https://community.roonlabs.com/u/MusicD)\ **Post date:** [May 19, 2025, 6:06am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/14 "2025-05-19T06:06:08Z")
> [@David\_Aronson](#): > > there are people talking about random Tracks, Albums and Artists showing up in their favorites. I’m talking about music that you KNOW you don’t like or listen to. Being one of those users, this wasn’t Qobuz. It was a Roon bug. If you check your Qobuz app for these mysterious additions they did not show in the Qobuz App Library. ---
**Author:** ![Suedkiez](https://community.roonlabs.com/user_avatar/community.roonlabs.com/suedkiez/32/107321_2.png) [@Suedkiez](https://community.roonlabs.com/u/Suedkiez)\ **Post date:** [May 19, 2025, 6:07am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/15 "2025-05-19T06:07:11Z")
> [@MusicD](#): > > It was a Roon bug. Roon Labs said it was a Qobuz accounts issue ---
**Author:** ![MusicD](https://community.roonlabs.com/user_avatar/community.roonlabs.com/musicd/32/372347_2.png) [@MusicD](https://community.roonlabs.com/u/MusicD)\ **Post date:** [May 19, 2025, 6:10am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/16 "2025-05-19T06:10:28Z")
> [@Suedkiez](#): > > Roon Labs said it was a Qobuz accounts issue Mr Flibble says otherwise 😜 Audirvana and LMS were unaffected 🤷‍♂️ Ok, it was a Qobuz accounts issue but only with Roon 😉 ---
**Author:** ![MusicD](https://community.roonlabs.com/user_avatar/community.roonlabs.com/musicd/32/372347_2.png) [@MusicD](https://community.roonlabs.com/u/MusicD)\ **Post date:** [May 19, 2025, 6:15am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/17 "2025-05-19T06:15:47Z")
FWIW I use iOS Passwords app to manage my passwords. All my accounts use the feature to hide my email and iOS Passwords generates a random email. A fairly robust password strategy. The only account I’ve had hacked in the last 10 years is my Microsoft Hotmail/Outlook. Since then I have requested them to close that account and delete all data. Guess what, they haven’t 🤦‍♂️. I’m writing to Bill now. ---
**Author:** ![j\_a\_m\_i\_e](https://community.roonlabs.com/user_avatar/community.roonlabs.com/j_a_m_i_e/32/84101_2.png) [@j\_a\_m\_i\_e](https://community.roonlabs.com/u/j_a_m_i_e)\ **Post date:** [May 19, 2025, 6:33am UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/18 "2025-05-19T06:33:41Z")
> [@David\_Aronson](#): > > I believe that there has been a security breach at Qobuz. Let me explain… Unless it’s happened in the past pre-GDPR, or in the last 72 hours and is yet to be reported. I would be amazed if a French, data-centric company like Qobuz weren’t fully [aware of thier requirements under GDPR](https://gdprhub.eu/Article_33_GDPR) and the penalties they’d face for not disclosing a breach - €20 million or 4% of a company’s annual global turnover, whichever is greater. You wouldn’t get as far as signing an agreement with a major record label without being well aware of this. Not saying their codebase couldn’t have had bug in the past, where a ‘like’ was assigned to the wrong user ID, although I have never experienced that myself. This wouldn’t class as a breach of personally identifiable information. But a data-centric European company, dealing with major record labels and a large subscriber base, not disclosing a major breach of user details - that is known about at a senior or company wide levels - extremely unlikely I’d say, too much on the line. ---
**Author:** ![Jean\_Heude](https://community.roonlabs.com/letter_avatar/jean_heude/32/5_5575768a8748004e209b776fc1b2916d.png) [@Jean\_Heude](https://community.roonlabs.com/u/Jean_Heude)\ **Post date:** [May 21, 2025, 4:18pm UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/19 "2025-05-21T16:18:01Z")
I own a domain. Whenever I sign up to a service, I basically use another mail adress which all gets sent to my inbox (catchall). So the email I signed up with was qobuz@[mydomain].TLD Guess what I found in my Spam folder just now? An email received on 27.04 from [quotes@business1.theinsurancequoter.com](mailto:quotes@business1.theinsurancequoter.com), telling me to “sign up through Navan and get $500 back for continuing your booking through Navan”. And it of course got sent to my quboz email. Not sure what could be behind this except a data leak. Either they’re trying to hide the leak, which would be incredibly stupid, or they don’t know about it yet… ---
**Author:** ![Miguel\_Rode](https://community.roonlabs.com/user_avatar/community.roonlabs.com/miguel_rode/32/116755_2.png) [@Miguel\_Rode](https://community.roonlabs.com/u/Miguel_Rode)\ **Post date:** [May 21, 2025, 4:32pm UTC](https://community.roonlabs.com/t/qobuz-data-breach/299481/20 "2025-05-21T16:32:51Z")
> [@Jean\_Heude](#): > > I own a domain. Whenever I sign up to a service, I basically use another mail adress which all gets sent to my inbox (catchall). That’s a brilliant idea. I own a couple of domains too, but it never occurred to me to generate unique email addresses for different purposes. Looks like several of you are agreeing that it’s likely that Qobuz had a data leak and haven’t acknowledged it. A bit disappointing for a company that otherwise provides a good service and integrates really well with Roon… [Next page](https://community.roonlabs.com/t/qobuz-data-breach/299481.md?page=2)