SoundCloud Data Breach
Gravity Score
CriticalCalculated based on the types of data exposed (6 categories) and the volume of affected records (29,815,722).
On creator platforms, users often choose to make parts of their profile public, such as a stage name or follower counts. The privacy risk grows sharply when someone can connect that public presence to a private email address.
SoundCloud reported that it found unauthorised activity that enabled an attacker to link publicly visible profile information to email addresses for a significant portion of users. An extortion attempt followed, and the data was later released publicly.
The exposed information included email addresses alongside names, usernames, avatars, and profile statistics like follower and following counts. For some users, a country field was also included, adding extra context that can support targeted outreach.
Roughly 30 million unique email addresses were impacted. Even without passwords, the scale and the ability to map a public profile to an inbox can drive phishing campaigns and broader account targeting across the internet.
Exposed data
What to do based on this breach
What can we learn from this breach?
The takeaway is that linking public profile data with private identifiers like email can defeat the separation users expect. Platforms should prevent easy correlation and protect any mechanism that enables mapping profiles to inboxes. Strong monitoring for unusual activity and fast incident response help reduce the exposure window.
Was your data exposed?
Check now if your email appears in this breach. It's free, takes 30 seconds and requires no signup.
Check my email
