SoundCloud soundcloud.com SoundCloud data breach: what happened and what to do
In December 2025, attackers took SoundCloud user data and later released it. Have I Been Pwned lists 29,815,722 accounts with email addresses, names, usernames, avatars and locations. SoundCloud said no passwords or financial data were accessed.
View all 13,115 breaches- Breach date
- 15 Dec 2025
- Affected
- 29,815,722
- Data exposed
- Avatars, Email addresses, Geographic locations, Names, Profile statistics, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
SoundCloud is where many independent artists publish and where plenty of listeners keep playlists. In mid-December 2025, the company detected unauthorised activity, and in January 2026 the stolen data was released. Have I Been Pwned (HIBP) added 29,815,722 accounts on 27 January 2026.
What happened
HIBP dates the breach to 15 December 2025. SoundCloud told reporters it had activated its incident response procedures after seeing unauthorised activity on an ancillary service dashboard, a support tool outside its main platform. The company later said about 20 percent of its users were affected.
In an update on 15 January, SoundCloud said the attackers had made demands and used email flooding to harass users, employees and partners. Email flooding means burying a target's inbox in junk so that real messages get lost. The data was released publicly the following month.
SoundCloud's investigation concluded that no sensitive data such as financial or password information was accessed. It said the data involved consisted of email addresses and information already visible on public SoundCloud profiles. The 29.8 million figure comes from HIBP's analysis of the released files, not from the company.
What was exposed
HIBP lists six data types: avatars, email addresses, geographic locations, names, profile statistics and usernames. Profile statistics are public numbers like follower counts.
What that lets criminals do
Most of this was already visible on public profiles. The part that was not public, in most cases, is the email address attached to each profile. That link is what scammers want. It lets them contact a named artist or fan directly, with details that look insider.
Expect phishing that mentions SoundCloud. Typical versions claim a copyright strike, a takedown notice, a payout problem or a verification request, and they link to a fake login page. Artists are especially exposed, because a message about a track being removed or a royalty issue gets quick attention.
The email flooding the attackers used is itself a warning sign. Floods are sometimes used to hide a real security alert, such as a password reset or a purchase confirmation, among the noise. If your inbox suddenly fills with junk, look for the messages from your bank or other accounts that may be buried in it.
The company's response
SoundCloud investigated, concluded that passwords and financial data were not accessed, and published an update on 15 January. For current guidance, see SoundCloud's own security notices.
Staying ahead of it
Since passwords were not part of this, the main work is about spotting fake messages and keeping your email account locked down. If you publish music on SoundCloud, add a second check before acting on any message about your tracks: open the site yourself, look at the notifications there, and ignore anything that pushes you to act within hours. Real copyright and payout notices appear inside your account, not only in an email.
What to do if you were in it
- 1
Treat messages about SoundCloud with suspicion
Fake copyright claims, takedown notices and payout alerts are the likely lures. Open SoundCloud directly and check your notifications there.
- 2
Lock down your email account
Your email address is the key exposed here. Use a unique password and two-factor authentication on it, because it resets everything else.
- 3
Change your SoundCloud password and turn on two-factor authentication
Passwords were not reported as exposed, but a fresh unique password costs little. Change it anywhere you reused it.
- 4
Look through a flooded inbox
If you get a sudden pile of junk email, search for password reset, bank and payment messages that might be buried inside.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Frequently asked
Was I affected by the SoundCloud data breach?
HIBP lists 29,815,722 accounts. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the SoundCloud breach?
Avatars, email addresses, geographic locations, names, profile statistics and usernames.
Were passwords exposed?
SoundCloud said no sensitive data such as passwords or financial information was accessed.
Should I change my password?
It is not strictly required, but it is a cheap precaution. Prioritise your email account and any password you reused.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
