SoundCloud Data Breach

In late January 2026, a dataset containing 29.8 million SoundCloud user records appeared on underground forums and was subsequently loaded into Have I Been Pwned. The exposed data included email addresses, usernames, and bcrypt password hashes. SoundCloud confirmed the legitimacy of the data, stating it appeared to be from a security incident. The breach affected accounts created before a certain date, and SoundCloud prompted affected users to reset their passwords.

SoundCloud is one of the world's largest audio streaming platforms, hosting millions of tracks used by independent artists and major labels alike. Founded in 2007, it has accumulated a vast user base over nearly two decades.

The exact initial access vector was not publicly disclosed. The data is believed to have been obtained through unauthorized access to SoundCloud's user database, suggesting a server-side compromise or an insider threat. Passwords were stored using bcrypt hashing, which, while not unsalted MD5, is still susceptible to brute-force attacks on weak passwords.

Unknown threat actors; data sold on underground forums for credential stuffing and phishing campaigns.

Attribution sources

• Have I Been Pwned
• BleepingComputer

Countries affected

• Global

Data types

• Email addresses
• Usernames
• Password hashes (bcrypt)

Reputational damage and potential regulatory fines under GDPR.

Public reaction

Concern among musicians and listeners over account security on a major creative platform.

GDPR investigation possible given SoundCloud's German headquarters.

Significance

One of the larger music platform breaches, affecting a significant portion of SoundCloud's user base.

Legacy

Reinforces the importance of strong password hashing and prompt user notification after breaches.

Publishing organisations

• BleepingComputer
• Have I Been Pwned

SoundCloud confirmed the breach and prompted affected users to reset their passwords.

Official documents

• SoundCloud security notification

References

1. [1]BleepingComputer: SoundCloud data breach coverage
2. [2]Have I Been Pwned - SoundCloud breach listing