SoundCloud data breach: 29.8M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-01-27
In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform. The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month. Exposed data: avatars, email addresses, geographic locations, names, profile statistics, usernames. The breach dates from Dec 15, 2025; Have I Been Pwned loaded it on Jan 27, 2026.
What to do
- If you had a SoundCloud account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
