SoundCloud Breach Exposed Emails for About 20% of Users
What Happened
SoundCloud confirmed a security incident that exposed the email addresses of roughly 20% of users after an attacker accessed an “ancillary service dashboard.” SoundCloud said only emails and public profile details were exposed, with no evidence of password or financial data access. The incident coincided with service disruptions and later DDoS activity.
Timeline: From First Access To Latest Update
SoundCloud has not released an exact intrusion start date, but disruption and investigation appear to have occurred in mid-December 2025. Users reported outages and VPN-related “403 Forbidden” errors as security controls tightened. SoundCloud confirmed the incident on December 15, 2025, said access was contained, and noted follow-on DDoS attacks contributed to instability.
What Data Or Systems Were Affected
Exposed data was limited to user email addresses and public profile information (such as display names and profile URLs). While SoundCloud described it as limited, exposed emails increase phishing and credential-stuffing risk. External estimates suggested roughly 28 million accounts affected, but SoundCloud did not confirm a count.
Who Was Responsible (Confirmed Vs Alleged)
SoundCloud did not identify the attacker. Some media reports linked the incident to ShinyHunters, but there has been no official attribution from SoundCloud or law enforcement. Reports also mentioned alleged ransom activity, which SoundCloud has not confirmed.
How The Attack Worked (If Known)
SoundCloud said the attacker accessed an ancillary dashboard, implying compromise of an internal or supporting tool rather than the main streaming platform. The initial access vector has not been disclosed, and public reporting has not confirmed whether it involved stolen credentials, third-party exposure, misconfiguration, or exploitation of a vulnerability.
Company Response And Customer Remediation
SoundCloud said it activated incident response protocols immediately, contained unauthorized access quickly, and brought in third-party cybersecurity experts. It warned users about phishing attempts, especially messages impersonating account verification or payment issues. Incident response actions and later DDoS activity were linked to the VPN access issues and outages reported by users.
Government, Law Enforcement, And Regulator Actions
As of mid-December 2025 reporting, no confirmed law enforcement actions or regulator enforcement steps were publicly tied to the incident. Public disclosures focused on containment and user risk warnings, with no public indication of penalties or formal proceedings during the initial reporting window.
Financial, Legal, And Business Impact
SoundCloud has not disclosed direct financial impact figures. Likely cost areas include forensics, legal review, notification requirements, customer support, security controls, and DDoS mitigation. Reputational risk and user frustration from service instability may also affect engagement. No major lawsuits were widely reported during the immediate disclosure window.
What Remains Unclear
- Intrusion start date and duration: SoundCloud has not confirmed when the attacker first gained access or how long access persisted.
- Initial access method: No public details confirm whether this involved stolen credentials, third-party compromise, misconfiguration, session hijacking, or a vulnerability exploit.
- Exact affected-user count: SoundCloud cited “approximately 20%,” but did not publish a concrete number. External estimates (around 28 million) remain unverified.
- Confirmed attribution: Media reporting linked the activity to ShinyHunters, but SoundCloud and law enforcement have not publicly validated that claim.
- Ransom activity: Reports referenced alleged ransom discussions, but SoundCloud has not confirmed any demand or payment.
- Remediation scope: It remains unclear whether SoundCloud will provide identity monitoring or additional user protections beyond phishing warnings and security hardening.
Why This Incident Matters
Email-only exposure still creates real risk because confirmed emails tied to a known service make phishing and credential-stuffing more effective. The incident also highlights how internal dashboards and operational tools can become high-value targets. Service disruptions further show how incident response measures can impact legitimate users, especially those on VPNs.
Sources
- BleepingComputer — SoundCloud confirms breach after member data stolen, VPN access disrupted (December 15, 2025)
https://www.bleepingcomputer.com/news/security/soundcloud-confirms-breach-after-member-data-stolen-vpn-access-disrupted/ - SecurityWeek — User Data Compromised in SoundCloud Hack (December 16, 2025)
https://www.securityweek.com/user-data-compromised-in-soundcloud-hack/ - The Register — SoundCloud bounces some VPNs as it cleans up cyberattack (December 16, 2025)
https://www.theregister.com/2025/12/16/soundcloud_cyberattack_data_leak/ - TechRadar — Soundcloud confirms data breach, user info stolen, here’s what you need to know (December 2025)
https://www.techradar.com/pro/security/soundcloud-confirms-data-breach-user-info-stolen-heres-what-you-need-to-know - Cybernews — SoundCloud data breach affects 20% of users (December 2025)
https://cybernews.com/security/soundcloud-data-breach-affects-fifth-of-users/ - SC Media — SoundCloud suffers data breach, user information accessed (December 2025)
https://www.scworld.com/brief/soundcloud-suffers-data-breach-user-information-accessed - BetaNews — SoundCloud warns of data breach with ‘limited data’ of a fifth of its users (December 16, 2025)
https://betanews.com/2025/12/16/soundcloud-warns-of-data-breach-with-limited-data-of-a-fifth-of-its-users/ - The Cyber Express — SoundCloud Confirms Cyberattack, Limited User Data Exposed (December 2025)
https://thecyberexpress.com/soundcloud-cyberattack/ - Cybersecurity Now (CyberInsider) — SoundCloud discloses data breach incident impacting 20% of users (December 16, 2025)
https://www.cybersecurity-now.co.uk/article/274217/soundcloud-discloses-data-breach-incident-impacting-20-of-users - SoundCloud — Transparency Reports page (accessed December 2025)
https://soundcloud.com/transparency-reports
Get In Touch
