SoundCloud Data Breach (2025): What Was Exposed & What To Do

In December 2025 SoundCloud disclosed that unauthorised activity on its platform had enabled an attacker to link publicly visible profile information to email addresses belonging to roughly 20 percent of its user base. The company reported that approximately 29.8 million individuals were affected, with the exposed records containing 30 million unique email addresses along with associated names, usernames, avatars, follower and following counts, and, in some cases, country information. The data were later released publicly after an extortion attempt. The incident is one of several large-scale exposures of user account data reported in the final months of 2025, underscoring how platforms that store even limited personal identifiers remain attractive targets for data collection and resale.

What happened

SoundCloud stated on 15 December 2025 that it had detected unauthorised activity allowing an attacker to map publicly available profile data to email addresses. The company indicated that the resulting dataset covered roughly 29.8 million users and included 30 million unique email addresses together with names, usernames, avatars, profile statistics such as follower and following counts, and geographic locations for some accounts. After the initial discovery, the actors attempted to extort SoundCloud and subsequently released the material publicly the following month.

Details on the precise method of initial access, the duration of the activity, and the full scope of any additional systems accessed remain undisclosed in the available reporting.

How a breach like this happens

Incidents involving the linkage of public profile data to internal identifiers often begin with an attacker obtaining limited access to a platform’s backend or user database. Once inside, an adversary can query or export records that pair visible usernames with stored email addresses. Such access may result from compromised credentials, misconfigured permissions, or vulnerabilities in application programming interfaces that return user information.

After extraction, the collected data are frequently used for extortion or sold on underground forums. Public release can follow if demands are not met, increasing the long-term availability of the information.

About SoundCloud

SoundCloud operates a large audio-distribution platform used by independent creators and listeners worldwide. Like other services in the streaming and social-media sector, it maintains user accounts that include contact details, profile images, and activity metrics. These records are necessary for account management, notifications, and content discovery features.

Because the platform holds direct identifiers such as email addresses alongside publicly visible usernames, any exposure can combine information that was previously fragmented across separate sources.

What was likely exposed

The information named in SoundCloud’s announcement includes email addresses, names, usernames, avatars, follower and following counts, and geographic locations for some users. The company reported approximately 30 million unique email addresses associated with the 29.8 million affected accounts.

Whether additional fields such as passwords, payment details, or private messages were accessed has not been disclosed. Organisations of this type commonly store further account metadata, but the exact contents of the released dataset beyond the listed categories remain unconfirmed.

What's at stake

Exposed email addresses combined with usernames and locations can facilitate targeted phishing campaigns and unwanted contact. When profile statistics are also available, the data may be used to build more convincing impersonation attempts or to enrich existing datasets sold for marketing or fraud purposes.

For the organisation, the incident adds to the operational burden of notifying users, investigating the access method, and managing reputational effects. For individuals, the primary concern is the persistence of email addresses in circulation, which can increase exposure to unsolicited messages over time.

What to do if you're exposed

Users who believe their information may have been included should review recent login activity on their SoundCloud account and any linked services that share the same email address. Enabling or confirming multi-factor authentication on those accounts reduces the value of the exposed email for further compromise.

Monitoring for unusual messages and avoiding reuse of the exposed email for sensitive registrations are standard precautions. Readers can run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.