Quick Answer: A class action lawsuit filed February 4, 2026 alleges SoundCloud failed to protect nearly 30 million users’ personal data from the ShinyHunters hacker group in a cyberattack discovered December 2025. The compromised data includes email addresses, usernames, display names, and location data. No passwords or financial information were exposed. If you have a SoundCloud account, check HaveIBeenPwned.com to see if your data was included.
The breach hit approximately 29.8 million accounts — about 20% of SoundCloud’s entire user base. The data was first leaked online in January 2026 after ShinyHunters attempted to extort the company.
A lawsuit filed in the U.S. District Court for the Southern District of New York (Case No. 1:26-cv-00980, Merkel v. SoundCloud Inc.) alleges SoundCloud “recklessly failed to implement standard cybersecurity measures” and “maintained users’ PII in a negligent manner.” SoundCloud has not yet responded publicly to the lawsuit’s allegations.
What Data Was Exposed?
✗ Data Exposed in Breach
- Email addresses
- Usernames and display names
- Profile avatars
- Follower and following counts
- Country of origin/geographic location
- Profile statistics
✓ Data NOT Exposed
- Passwords
- Financial data or payment information
- Private messages
- Private audio content
- Social Security numbers
The breach occurred through unauthorized access to an internal service dashboard, according to Fox News reporting. The method allowed attackers to connect hidden email addresses to publicly available profile data — a technique designed to build detailed profiles of users for phishing or spam campaigns.
Why Exposed Email Addresses Still Matter: Even without passwords, having your email address + username + location profile in criminal hands creates real risk. It enables targeted phishing attacks (“Your SoundCloud account has been compromised — click here”), credential stuffing against other accounts where you reused passwords, and spam tied to your specific musical interests and location.
How to Check if You Were Affected
- Check HaveIBeenPwned.com: Go to haveibeenpwned.com and enter your email address. The SoundCloud breach has been indexed. If you see it in your results, your data was exposed.
- Watch for unusual emails: Be suspicious of any email claiming to be from SoundCloud asking you to verify your account, reset a password, or take action on a “suspicious login.” These are likely phishing attempts using your exposed data.
- Check your inbox for the SoundCloud breach notification: SoundCloud was expected to notify affected users. Check your spam folder if you haven’t received one.
What the Lawsuit Alleges
The class action filed on behalf of Alexander Merkel, a California resident, alleges SoundCloud violated multiple legal duties to protect user data. According to the complaint, the company:
The Daily Money Brief — Free, at 10 AM
Money you may be owed, scams to dodge, and the fine print decoded — the consumer money news that affects your wallet, every weekday.
- Failed to implement adequate cybersecurity measures despite having notice that hackers like ShinyHunters actively target user databases
- Maintained user personal information in a negligent manner
- Failed to comply with FTC guidelines and industry-standard security practices
- Did not take reasonable steps to prevent unauthorized access to its internal dashboard
The lawsuit seeks class-wide damages for negligence, breach of implied contract, and unjust enrichment. The class is defined as anyone whose personal information was compromised in the breach — potentially covering all 29.8 million affected accounts.
ShinyHunters Pattern: This isn’t SoundCloud’s first exposure to this group. ShinyHunters has been behind numerous high-profile data breaches targeting online platforms. Their standard playbook is to steal data, demand ransom, and then leak it publicly when companies don’t pay. SoundCloud apparently didn’t pay — and 29.8 million users’ data was released online in January 2026.
What to Do Right Now
- Change your SoundCloud password immediately — even though passwords weren’t exposed, it’s good practice after any breach. Use a unique password you don’t use elsewhere.
- Check your other accounts for password reuse — if you used the same password at SoundCloud as elsewhere, change those accounts now. Password reuse is how most account takeovers happen after data breaches.
- Enable two-factor authentication (2FA) on SoundCloud and all accounts where it’s available. Even if attackers have your password, 2FA blocks access.
- Be extra vigilant about phishing emails — any email referencing your SoundCloud account, especially ones asking you to “verify,” “confirm,” or “click here” — treat as suspicious. Go directly to soundcloud.com rather than clicking email links.
- Monitor your email for suspicious activity — your email address is now in criminal hands. Set up alerts on your primary email account for unusual logins.
- Watch for class action notices — if you had a SoundCloud account before the breach, you may be eligible to join the class. Class action notices are typically sent to email addresses on file. If a settlement is reached, you may receive a claims notice.
Data breaches often trigger identity theft or fraudulent debt collection attempts. If unexpected collection notices start appearing after this breach, check Find Your Path to understand your options — and never pay a debt collector without first verifying the debt is real and legitimate.
Key Takeaways
- 29.8 million SoundCloud accounts were exposed in a December 2025 breach by ShinyHunters
- Data exposed: emails, usernames, display names, location, profile stats — no passwords or financial data
- A class action lawsuit (Merkel v. SoundCloud Inc.) was filed Feb. 4, 2026 in the SDNY
- Check HaveIBeenPwned.com to see if your account was included
- Change your password, enable 2FA, and watch for phishing emails using your exposed data
Frequently Asked Questions
Was my SoundCloud password exposed in the breach?
No. According to available information about the SoundCloud breach, passwords, financial data, and private content were not exposed. The compromised data was limited to publicly-linked profile information including email addresses, usernames, display names, location data, and profile statistics. That said, you should still change your SoundCloud password as a precaution, and especially if you’ve reused that password on other accounts.
How do I know if my SoundCloud account was part of the breach?
Visit HaveIBeenPwned.com and enter the email address associated with your SoundCloud account. The site indexes data breach databases and will tell you if your email appeared in the SoundCloud breach. You can also set up free alerts to be notified of future breaches involving your email address.
Who is ShinyHunters and why should I be concerned?
ShinyHunters is a prolific hacker group known for stealing and selling or leaking large databases from online platforms. They have been linked to dozens of major data breaches. Their typical method is to steal data, extort the company, and release the data publicly when demands aren’t met. Once released, the data circulates among criminal networks and is used for phishing, identity theft, credential stuffing, and targeted spam for years afterward.
How do I join the SoundCloud data breach class action lawsuit?
The class action (Merkel v. SoundCloud Inc., Case No. 1:26-cv-00980, SDNY) was just filed in February 2026 and has not yet reached the settlement or claims stage. You do not need to take any action now to preserve your rights — anyone whose data was compromised would automatically be part of the class. Watch for future notices via your SoundCloud-associated email address. If a settlement is reached, you’ll receive information about how to file a claim.
What should I do if I start getting suspicious emails or calls after this breach?
Treat all unexpected contact that references your SoundCloud account as a potential phishing attempt. Never click links in such emails — go directly to SoundCloud.com. If you receive calls from debt collectors or financial companies you don’t recognize, verify the debt independently before paying anything. Data breaches are frequently followed by waves of fraudulent debt collection attempts targeting the exposed individuals. If you believe you’re being contacted fraudulently, file a complaint with the FTC at reportfraud.ftc.gov.
Sources: Top Class Actions — SoundCloud Data Breach Lawsuit | Fox News — SoundCloud Data Breach | Have I Been Pwned — SoundCloud Breach
Dealing With Debt? Understanding your options is the first step. See how all your debt relief options compare — including ones most sites won’t tell you about. The Find Your Path quiz gives a recommendation based on your actual numbers, and the Scam-O-Meter checks any company’s complaint history before you sign. Federal Reserve research shows bankruptcy filers recover faster than those who don’t file.
