Sound Radix Breach Exposes 293 K Email Addresses, Names, and Passwords
What Happened – In March 2026, audio‑production‑tool provider Sound Radix disclosed that a breach exposed approximately 293 000 unique email addresses, names, and potentially hashed passwords. The company self‑reported the incident to Have I Been Pwned (HIBP). No financial or credit‑card data were reported as compromised.
Why It Matters for Trust & Control Assurance
- The exposure of credential data illustrates a failure to protect authentication assets – a core control that continuous‑monitoring programs must evidence.
- Demonstrating robust identity‑access controls (password hashing, rotation, MFA) provides defensible audit evidence across frameworks such as NIST CSF 2.0.
- A breach of this type triggers immediate requirements for incident‑response documentation and proof of remedial actions to maintain stakeholder trust.
Who Is Affected – SaaS vendors serving creative‑media and production teams; their customers (marketing agencies, broadcasters, podcasters) that store employee or user credentials in Sound Radix accounts.
Recommended Actions
- Verify whether any of your users’ credentials appear in the disclosed list; force password resets where applicable.
- Review password‑storage practices (hashing algorithm, salting) and enforce multi‑factor authentication for all privileged access.
- Capture evidence of the remediation steps (reset logs, MFA rollout) for audit readiness and continuous‑control reporting.
Source: HIBP breach record
Technical Notes – The breach vector was not disclosed; the data includes email addresses, full names, and hashed passwords. No CVE or specific vulnerability was identified.
Source: HIBP breach summary