Soundwave Data Breach (2015): What Was Exposed & What To Do

Breaking down the breach

The breach occurred around the middle of 2015. Production data had been copied into a test database, which was then inadvertently left exposed through a MongoDB instance. The exposed material contained approximately 130,000 records. Public reports listed the following data elements: dates of birth, email addresses, genders, geographic locations, names, passwords stored as unsalted MD5 hashes, and social connections. No further technical details on the duration of exposure or the method of discovery were disclosed at the time.

How a breach like this happens

Incidents involving test or development environments often stem from routine data-handling practices. Organisations sometimes populate test systems with copies of live records to simulate real conditions. When those systems are connected to databases that lack access restrictions or are reachable from the public internet, the copied data can become visible without additional authentication. Such exposures are typically the result of configuration oversights rather than deliberate external intrusion.

Soundwave and its sector

Soundwave operated as a mobile application that allowed users to track music listening habits and share activity with others. Services of this type routinely collect account information, demographic details, and social graph data to support personalisation and connectivity features. A breach at an organisation holding these records is consequential because the data can be used to link individuals across multiple platforms and because password hashes without additional protections can be processed more readily by automated tools.

The information in question

The records reported as exposed included dates of birth, email addresses, genders, geographic locations, names, passwords, and social connections. The passwords were stored as MD5 hashes without a salt. Exact confirmation of every field present in the dataset remains limited to the categories listed in contemporaneous reports.

The real-world impact

Individuals whose information appeared in the exposed records face the possibility that their email addresses and other identifiers could be used for targeted phishing or that unsalted password hashes could be cracked and reused on other services. The organisation itself faced reputational consequences and the operational task of notifying affected users and securing its infrastructure. No monetary loss figures or subsequent legal actions were detailed in the initial reporting.

What to do if you're exposed

Anyone who used Soundwave around the time of the incident should treat any password associated with the service as potentially known to others and change it on any account where the same password was reused. Enabling multi-factor authentication on linked email accounts reduces the chance that a recovered password alone can be used for further access. Monitoring for unusual login attempts or unsolicited messages that reference personal details from the records is also prudent.

• Change passwords on the affected account and any other services that share the same credential.
• Enable multi-factor authentication wherever available.
• Watch for phishing attempts that reference details such as date of birth or location.
• Run a free exposure scan of your email address against known breach datasets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.