SoundCloud Data Breach

What happened?

In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform . The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month.

When did it happen?

The breach date in the public record is December 15, 2025. The record was added to the catalogue on January 27, 2026 and last updated there on January 27, 2026.

What information was reported as exposed?

• Avatars
• Email addresses
• Geographic locations
• Names
• Profile statistics
• Usernames

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with SoundCloud or used soundcloud.com around December 15, 2025. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.