SoundCloud suffered a data breach in late 2025 when an attacker gained unauthorized access to systems and mapped publicly available profile data to the private email addresses of approximately 29.8 million users. The threat actor, attributed to the ShinyHunters collective, is believed to have used scraping techniques to extract and link user records. After the initial breach, the attackers attempted to extort SoundCloud before publicly releasing the stolen data in January 2026. The exposed data includes email addresses, names, usernames, profile avatars, follower and following counts, and in some cases the user's country. While no financial data or account passwords were compromised, the breach is considered high risk because it effectively deanonymized a large share of SoundCloud's user base. Linking a private email address to a public profile allows attackers to identify who is behind an account, enabling targeted phishing, account takeover attempts, and harassment of both listeners and creators. SoundCloud disclosed the incident and notified affected users following discovery. No class-action lawsuits or regulatory enforcement actions had been publicly documented as of early 2026. Affected users should be alert to phishing emails that reference their SoundCloud activity, as attackers can now craft convincing messages using profile-specific details. Updating passwords and enabling two-factor authentication on any account sharing the same email address is strongly advised.

Audio-sharing and streaming platforms collect user accounts, emails, profile data, listening history, uploads, social relationships, and creator activity across music and creator workflows.

SoundCloud has navigated sustained financial pressure and ownership changes through the 2020s. The company sold a majority stake to a consortium including Sirius XM in 2017. It has continued developing monetization tools for creators and has maintained its position as a key independent artist platform despite competition from Spotify, Apple Music, and YouTube. The December 2025 breach was the most significant security event of the recent period.