SoundCloud Breach Exposes Nearly 30 Million User Accounts
What Happened — In December 2025 SoundCloud announced that an attacker gained unauthorized access to its platform and was able to map publicly available profile information to email addresses for roughly 20 % of its users, affecting about 29.8 million accounts. The exposed data set included email addresses, usernames, avatars, follower/following counts, names and, in some cases, the user’s country. The threat actors attempted to extort SoundCloud before publicly releasing the data in January 2026.
Why It Matters for Trust & Control Assurance —
- It underscores the control objective of robust access management for publicly exposed APIs – a gap that continuous‑control‑assurance programs are built to detect and remediate.
- The incident shows why real‑time monitoring of data‑access anomalies is essential for producing defensible audit evidence and meeting regulatory expectations.
- Aligns directly with Verisq’s Access Controls capability, which helps organizations enforce least‑privilege policies, log access events, and demonstrate compliance across frameworks.
Who Is Affected — Music‑streaming services, SaaS platforms with large user bases, and any organization that publishes user‑profile APIs without strict access restrictions.
Recommended Actions —
- Conduct a comprehensive review of API endpoints and enforce authentication, rate‑limiting, and least‑privilege access controls.
- Deploy continuous monitoring for abnormal data‑extraction patterns and retain logs as audit‑ready evidence.
- Refresh privacy notices, update breach‑notification playbooks, and ensure readiness for regulator‑mandated disclosures.
Technical Notes — The breach leveraged unrestricted public profile endpoints, enabling automated scraping and correlation with email addresses; no specific CVE was disclosed. Exposed data types: email, name, username, avatar, follower/following counts, and country. Source: [Have I Been Pwned – SoundCloud breach]