SoundCloud confirms security breach after outages expose user email and profile data

Audio streaming platform SoundCloud has confirmed that recent service outages and VPN-related access issues were caused by a security breach in which threat actors accessed a database containing users’ email addresses and profile information.

The company said it recently detected unauthorized activity involving an ancillary service dashboard and immediately activated its incident response procedures. The incident came to light after users reported being unable to access SoundCloud for several days when connected through virtual private networks, with attempts returning 403 “forbidden” errors.

SoundCloud acknowledged that a threat actor accessed some of its data but said the exposure was limited in scope. The company confirmed that no sensitive information such as passwords or financial data was accessed. The compromised data consisted only of email addresses and information already visible on public SoundCloud profiles.

The breach is believed to affect approximately 20 percent of SoundCloud’s user base. Based on publicly available user figures, the exposure could involve tens of millions of accounts. SoundCloud said it has completed its investigation and is confident that all unauthorized access to its systems has been blocked, adding that there is no ongoing risk to the platform.

As part of its response, SoundCloud worked with third-party cybersecurity experts to strengthen its security posture. Measures included enhancing monitoring and threat detection capabilities, reviewing and reinforcing identity and access controls, and conducting a broader assessment of related systems.

However, the company said configuration changes made during the response process disrupted VPN connectivity for some users. SoundCloud has not provided a timeline for when VPN access will be fully restored.

Following the containment of the breach, SoundCloud experienced multiple denial-of-service attacks that temporarily disabled web access to the platform. The company said those attacks were mitigated and did not affect mobile applications.

SoundCloud has not publicly identified the threat actor responsible for the breach. The company confirmed that it has published a security notice outlining the incident and its remediation efforts.

SoundCloud is a global music hosting and streaming service that allows artists to upload, share, and distribute audio content directly to listeners worldwide.