Skip to content
vindicis

SoundCloud data breach — are you affected?

In December 2025 SoundCloud reported unauthorised activity that let an attacker map public profile data to email addresses for roughly one fifth of its users. The data covers about 30 million email addresses with names, usernames, avatars and follower counts, and sometimes the country. The attackers later attempted to extort the company.

Key facts
Verified
Breach date
15 December 2025
Accounts affected
29,815,722
Added to catalogue
27 January 2026
Website
soundcloud.com

Data exposed

  • Avatars, lower risk
  • Email addresses, lower risk
  • Geographic locations, lower risk
  • Names, lower risk
  • Profile statistics, lower risk
  • Usernames, lower risk

Colour shows how damaging the data is if misused.Credentials, ID and bank dataContact and personal detailsOther profile data

What this means for you

Based on the types of data in this breach, in order of importance.

  • Expect more targeted phishing

    Your email address ties you to this service, which is enough for a believable message such as a fake account warning. Check the sender and the web address before you sign in, and go to the site directly instead of using links in email.

  • Limit what attackers can personalise

    Names, employers, job titles and social profiles make impersonation and spear-phishing easier. Check what your public profiles reveal, and be careful with unexpected requests that use your real name or workplace.

  • Review privacy settings

    Location, IP and device details are mostly a privacy concern. Review the settings of the services you still use and delete accounts you no longer need.

Check your own email address

Run a free self-assessment for an email address you own. VINDICIS checks it against infostealer logs and several public breach sources and shows a summary in seconds.

Built for your own addresses. It is not a tool to look up other people.

Run a free self-assessmentCheck a password

Related breaches

Breaches that exposed similar kinds of data.

Frequently asked questions

Was my data in the SoundCloud breach?

Only a check of your own address can tell. If you had an account with SoundCloud around 2025, assume it might be. Run the free self-assessment with an email address you own: VINDICIS checks it against several public breach sources and shows a summary in seconds. It is built for your own addresses, not for looking up other people.

What information was exposed in the SoundCloud breach?

According to the Have I Been Pwned catalogue, the SoundCloud breach affected 29,815,722 accounts and exposed: Avatars, Email addresses, Geographic locations, Names, Profile statistics, Usernames. The incident dates from 15 December 2025.

What should I do if I had a SoundCloud account?

Review the security settings of your SoundCloud account and treat unexpected emails, texts or letters that mention SoundCloud with suspicion. Delete the account if you no longer use it.

Is it safe to check my email address on VINDICIS?

Yes. The free scan is not stored or logged, results stay in memory for four hours at most, and your browser only talks to this site. The password checker hashes locally and sends only five characters of the hash, so the password never leaves your device.