high severity December 15, 2025 · 3 min read

SoundCloud Data Breach (2025)

If you are a customer of SoundCloud, here’s what’s now in circulation.

In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform. The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month.

On December 15, 2025, SoundCloud disclosed that attackers had mapped publicly available profile data to 30 million unique email addresses, exposing names, usernames, avatars, follower counts, geographic locations, and profile statistics for roughly 29.8 million users.

Named in this incident?

You can’t unleak data. You can take away what it’s worth.

A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.

See what is exposed about you — free scan →

Watch SoundCloud

Get alerted the next time SoundCloud files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.

We’ll email you only about SoundCloud’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.

Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.

What Public Reporting Shows

SoundCloud stated it first identified unauthorised activity in December 2025. The breach did not involve a compromise of passwords or direct access to private account content. Instead, the attackers combined publicly visible profile information with email addresses that had been linked to those accounts. Public reporting indicates the exposed dataset contained approximately 30M unique emails, real names where provided, usernames, avatar links, follower and following counts, and country-level location data in some records.

The attackers attempted to extort the company. When those demands were not met, they released the dataset publicly the following month. Industry research from sources such as DoxxScan™ continuous monitoring confirms the scale and content of the leak.

Exposure Pack · one payment

The full list, and what to lock in ten minutes.

Every indexed leak tied to your address — all of them, named and dated
A deeper search of collected breach data — the kinds of your information it holds, where it finds you
What this kind of incident typically exposes
A ten-minute lock list written for this kind of organisation

One payment. Nothing renews, and no account is created. Emailed to you within a minute.

Why This Matters for You and Your Family

If you have ever used SoundCloud, your email address, real name, username, and rough location may now sit in a readily downloadable file. That combination makes it easier for someone to connect your online handle to your real-world identity. For families this risk extends beyond the account holder: children who use the same email address or household devices for music streaming can have their gaming usernames or social profiles linked back to the family address. Once that link exists, credential-stuffing attacks, phishing campaigns, and doxxing attempts become more targeted and more credible.

29.8 million users now face heightened risk of identity theft, spam, and harassment because one music platform inadvertently tied public creativity to private contact details.

The Doxxing and Identity-Chain Implications

A single breach rarely stays isolated. Usernames exposed in the SoundCloud incident frequently appear on gaming platforms, Discord servers, Twitch channels, and other services. Attackers can follow these trails—sometimes called identity chains—to build a fuller picture of you or your children. A leaked SoundCloud username paired with an email can unlock forgotten accounts, reveal linked phone numbers, or expose location patterns that lead to physical addresses. Public reporting describes this cascading effect as one of the most persistent dangers after large-scale profile leaks. Gaming accounts are especially vulnerable because children often reuse usernames and passwords across entertainment platforms, turning a music-streaming breach into a doorway for account takeovers on Roblox, Fortnite, or Steam.

What to Do

Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then complete the cleanup of exposed records.
Rotate the password used on SoundCloud anywhere it is reused and enable two-factor authentication through an authenticator app rather than SMS.
Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or email.
Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf.

The SoundCloud breach shows how quickly public creativity can become private exposure. Acting promptly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts—practical protection for the accounts you and your family actually use.

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove — and removing them is what we do.

value redacted in this sampleage, relatives, address historySpokeo

value redacted in this samplephone, household, property recordsBeenVerified

value redacted in this sample580 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach

unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Were you a SoundCloud customer?

SoundCloud is one listing. Your email is probably in others.

29.8M accounts were exposed here. Check whether yours is one — and find every other leak tied to the same address, in about 15 seconds. No account, no card.

Report details & sourcing

Severity High contact details only, none of them permanent

Disclosed December 15, 2025

Last reviewed July 22, 2026

Affected 29.8M

Data exposed AvatarsEmail addressesGeographic locationsNamesProfile statisticsUsernames

By GalaxyWarden Threat Research · Editorial & sourcing standards

Editorial & sourcing policy

GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.

Sources: Have I Been Pwned

Related breaches

high March 20, 2026