SoundCloud Data Breach Exposes 29.8 Million User Records

SoundCloud confirmed unauthorized access to an internal/ancillary service dashboard that enabled attackers to correlate hidden email addresses with information already visible on public SoundCloud profiles, impacting roughly 29.8 million accounts (about 20% of its user base). Exposed data was primarily email addresses plus public-profile metadata (e.g., usernames/display names, avatars, follower/following counts, and other profile statistics); SoundCloud stated no passwords or financial data were accessed. Users also reported service disruptions around the time of the incident, including access issues such as 403 Forbidden errors (notably when connecting via VPN), consistent with post-incident security changes and response actions.

Reporting attributed the intrusion and subsequent extortion attempt to the ShinyHunters group, with SoundCloud later acknowledging the actor made demands and used harassment tactics such as email flooding. The stolen dataset was subsequently leaked and then added to Have I Been Pwned for exposure checking, increasing downstream risk of targeted phishing and account-takeover attempts via credential stuffing on other services where users may have reused emails as identifiers. Separate contemporaneous claims by ShinyHunters against other companies (e.g., Panera Bread, CarMax, Edmunds) were reported but are distinct from the confirmed SoundCloud incident and include different alleged access vectors (e.g., stolen SSO codes).