Free tools Windows power users keep installed
One-click scans. No signup required.
Yes. SoundCloud confirmed unauthorized activity involving an ancillary service dashboard in December 2025. Its investigation, completed on February 24, 2026, found that the incident exposed email addresses linked to information already visible on public profiles—not passwords or financial data. SoundCloud says about 20% of users were affected.
What happened to SoundCloud?
SoundCloud says it detected unauthorized activity in a dashboard for an ancillary service in December 2025. The company activated its incident-response procedures, contained the activity and brought in external cybersecurity experts. In its final update on February 24, 2026, SoundCloud said its investigation was complete and that no sensitive data had been taken.
The incident did not mean that every part of SoundCloud was unavailable or compromised. In a December 15, 2025 notice, the company said the issue had been resolved and there was no continuing risk to platform security or availability. It also reported two denial-of-service attacks that temporarily disrupted web access, and temporary VPN access problems after defensive configuration changes.
What SoundCloud data was exposed?
SoundCloud says the affected data consisted of email addresses and information already visible on public SoundCloud profiles. The key exposure was the connection between an email address and a public profile: information that may have been visible separately could now be associated with a person’s email.
#1 Best Overall
Have I Been Pwned (HIBP) lists names, usernames, avatars, follower and following counts, and—in some cases—the user’s country, along with email addresses. The available accounts of the incident do not say that private messages, payment details or passwords were exposed.
How many accounts were affected?
SoundCloud estimates that approximately 20% of its users were affected. HIBP’s figures describe email addresses rather than a percentage of SoundCloud’s current user base, and appear in two forms: its breach overview lists 29.8 million affected addresses, while its live SoundCloud record says the data contained 30 million unique email addresses. The 30 million figure is rounded; the figures should not be treated as separate groups of victims.
HIBP records the breach as occurring in December 2025 and says it added the entry on January 27, 2026. Its count and SoundCloud’s percentage measure different things, so they are not directly interchangeable.
Were passwords or financial details exposed?
No, according to SoundCloud’s completed investigation. The company said that no sensitive data, including financial or password data, was accessed. HIBP’s listed fields likewise do not include passwords or financial information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
That finding does not make the exposed information harmless. An email address paired with a real name or public profile can make phishing, impersonation or other targeted messages more convincing. Treat unexpected messages with caution even if they refer to details that appear to match your SoundCloud account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who was behind the breach?
SoundCloud said a group claiming responsibility made demands and used email-flooding tactics to harass users, employees and partners. HIBP says the attackers later attempted to extort SoundCloud before publicly releasing the data the following month.
BleepingComputer reported that sources attributed the attack to the ShinyHunters extortion group. That attribution is reported, not a finding SoundCloud has officially confirmed.
Quick Recap
Best Value
How to check your email and secure your accounts
- Search for your email address using Have I Been Pwned’s email-search service, and review its SoundCloud breach entry. A match indicates your address appears in the listed incident data; it does not mean your password was exposed.
- Change your SoundCloud password, especially if you have reused it on another site. Change the reused password on every other account as well, using a different password for each service.
- Enable two-factor authentication on SoundCloud and other accounts wherever it is supported.
- Be alert for phishing, impersonation and email-flooding attempts. SoundCloud says it will never ask for your password or credentials. Do not click suspicious links or reply to messages that seem designed to provoke a response.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
