6 ms·
SoundCloud Data Breach Now on HaveIBeenPwned
- Alifatisk 9mo ago> the impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country
- loganc2342 9mo agoIf I’m understanding correctly, it sounds like, aside from the email addresses, all the data leaked was already publicly available on users’ SoundCloud profiles. The only novel aspect is linking that public data to the accounts’ email addresses.
- jacquesm 9mo agoThat step makes a big difference though.
- embedding-shape 9mo agoImportantly, 20% of the total userbase it seems: > In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform. The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. That's from the haveibeenpwned email which I received because of course I'm part of that 20%. Remember to have unique passwords for each website kids, ideally with a password manager.
- technion 9mo agoWhilst thats important advice, as far as I can tell it wouldnt help here as no passwords are breached. I had a few of our domain users on this report and as far as I can tell theres nothing actionable.
- pluralmonad 9mo agoAlso, never give out a direct email address, always an alias.
- fragmede 9mo agoand include a nonce. user+SoundCloud@gmail.com is obviously guessable. user+SoundCloudheuerue64@gmail.com ain't getting guessed.
- LoganDark 9mo agoGmail plus addressing is like the most widely known thing ever and also like the first thing checked by every scammer and hacker. It's so useless I've been using it for practically ever and spam related to brand new data breaches still has it stripped out. There have only ever been like two occasions where a spam email in my inbox didn't strip out the plus address. Use something like Firefox Relay where it's impossible to strip out anything.
- pluralmonad 9mo agoI mean aliases provided by some service providers. Never been of fan of the + style pretend aliasing. Takes very little sophistication to extract the real email. A real forwarding alias does not expose the true email.
- throwaway431234 9mo agoSoundCloud is the worst company, so hostile to former paying users! I am a hobbyist songwriter and have posted my rough mixes (Apple's Music Memo app which adds drum and bass automagically with two clicks & then mix it in Garage Band) on my SoundCloud for more then ten years. I signed up for their Artist Pro account and was a member for of such consistently for a few years at $17 a month. Once you cancel they then hold all your music hostage by hiding it and later threat to delete it. Horrid!
- crazybonkersai 9mo agoYou can export your entire profile using yt-dlp. Of course you have to do it, when you are still a paying customer.
- dylan604 9mo agoWhy would someone that writes their own songs, mixes in GarageBand, uploads to a 3rd party website need to use yt-dlp to get back the files that they themselves made? Yes, I'm intentionally victim blaming here. The victim is complaining about a 3rd party site deleting files. Who cares? Why would you have as your only source of your files the copies stored by the 3rd party?
- direwolf20 9mo agoNot only that, the victim is complaining about a paid file storage company deleting the files when the victim stops paying
- crazybonkersai 9mo agoYou get a point there, but export is mostly about metadata, eg images and description. Data loss happens too. Soundcloud may be your only source of your own tracks.
- throwaway431234 9mo agoDate of publication (copyright) is important to a songwriter. Soundcloud im sure knows this! Probably should have said this from the top!
- djee 9mo ago"The data involved consisted only of email addresses and information already visible on public SoundCloud profiles". So they've scraped public data. Why care?
- forgotaccount3 9mo agoMaybe the two public data points weren't connected before? I don't use SoundCloud, but if profiles didn't have contact information like Email Address on them then it could be meaningful to now connect those two dots. Like, 'Hey look, Person A, who is known to use email address X, kept Lost Prophets as one of their liked artists even after 2013!'
- refulgentis 9mo agoYou are 100% correct based on article. Not good that you're gray, and your parent of "who cares it was already available and scraped" is the top comment.
- cj 9mo agoBut, why care? (Yes, we can “care” that there was a leak - but… why worry? what new risk exists today that didn’t yesterday?) The data in the leak (other than follower count, etc) was already available for purchase from Zoominfo, 8sense, or a variety of other data brokers or other legal marketplaces for PII. I suppose the risk now is that the data is freely available and no longer behind a data broker’s paywall?
- refulgentis 9mo agoI'm confused, where were scrapers/data brokers/Zoominfo etc. were getting email addresses for SoundCloud accounts?
- cj 9mo agoThey don’t. I’m confused why that info is valuable.
- TechSquidTV 9mo agoA lot of "rap gods" are about to be exposed as "Kevin" from suburbia.
- giancarlostoro 9mo agoLil B is probably fine, but he is the biggest name I recall coming out of SoundCloud. He blew up all over the 2010s, he was the Kanye of Cloudrap too because he took dressing styles and changed it all up similar to Kanye.
- sam1r 9mo agoShout out to lil b and those parties at Berkeley he would perform at in ‘12, ‘13. Those were the golden sound cloud years.
- giancarlostoro 9mo agoI was big on tumblr, but he wasn't my style of rap, but I respect him for what he was able to pull off.
- gnabgib 9mo agoThere's a few big names: Post Malone, Billie Eilish, Lil Nas X, Khalid, Bad Bunny
- EGreg 9mo agoThis Kevin was still quite impressive https://en.wikipedia.org/wiki/Kevin_Mitnick https://en.wikipedia.org/wiki/Kevin_Mitnick
- ddtaylor 9mo agoThankfully the only artist I listen to on there has been known as Bryce from the suberbs for two decades: https://soundcloud.com/ytcracker https://soundcloud.com/ytcracker
- paulpauper 9mo agoall this leaked data pretty much used for one objective now: stealing crypto
- refulgentis 9mo agoKinda sad to see a "Recommended Actions", with only sponsors, with ad copy that would be understood by HN readers but not our non-technical friends. (i.e. a simple "Nothing. No passwords have been leaked yet, only metadata" in this case)
- WhereIsTheTruth 9mo agoBy aggregating breach data by email, this tool inadvertently exposes users's full web history, including sensitive sites like crypto/adult/dating platforms, to anyone who knows their address Fun
- rocky_raccoon 9mo agoFrom the FAQ [1]: What is a "sensitive breach"? HIBP enables you to discover if your account was exposed in most of the data breaches by directly searching the system. However, certain breaches are particularly sensitive in that someone's presence in the breach may adversely impact them if others are able to find that they were a member of the site. These breaches are classed as "sensitive" and may not be publicly searched. A sensitive data breach can only be searched by the verified owner of the email address being searched for. This is done by signing in to the dashboard which involves verifying you can receive an email to the entered address. Once signed in, all breaches (including sensitive ones) are visible in the "Breaches" section under "Personal". There are presently 82 sensitive breaches in the system including Adult FriendFinder (2015), Adult FriendFinder (2016), Adult-FanFiction.Org, Ashley Madison, Beautiful People, Bestialitysextaboo, Brazzers, BudTrader, Carding Mafia (December 2021), Carding Mafia (March 2021), Catwatchful, CityJerks, Cocospy, Color Dating, CrimeAgency vBulletin Hacks, CTARS, CyberServe, Date Hot Brunettes, DC Health Link, Doxbin and 62 more. [1] https://haveibeenpwned.com/FAQs#SensitiveBreach https://haveibeenpwned.com/FAQs#SensitiveBreach
- direwolf20 9mo ago> Bestialitysextaboo I laughed pretty hard
- WhereIsTheTruth 9mo agoYou don't get to gatekeep what counts as "sensitive", all of my privacy is non-negotiable
- fencepost 9mo agoSo I guess I should watch out for scams being sent to "soundcloud@" on a personal domain. Oh no, how will I distinguish them from my legitimate banking email???
- alexfoo 9mo agoClever spammers (there are some!) see the presence of company@<domain> and assume the user will have similar emails for other accounts, so it might be worth trying ebays scams to ebay@<domain> or banking scams to chase@<domain> or boa@<domain>. Sending is cheap so why not, you're not trying to fool everyone, only a few. I use a unique string per company but it's not guessable in advance, but it's obvious when looking at it and squinting a bit, for example (and these are not the exact ones I use): sundclod@<domain> or ebuy@<domain> or amzoon@<domain> Sure I have to remember them but it's easy for me to check and my password manager is filling them in for me 99.99% of the time. I can filter on those emails instead, and I also know that anything coming to soundcloud@<domain> or ebay@<domain> or amazon@<domain> is definitely spam as I've never used those addresses myself. If sundclod@<domain> appears in a leak I can (hopefully) change my account email at Soundcloud to sondclud@<domain> and then confine sundclod@<domain> to /dev/null
- direwolf20 9mo agoFor the more shady sites, I use first names or fake usernames.
- fencepost 9mo agoI have three different generations of email addresses associated with United Airlines that all receive spam. Never any disclosed breaches AFAIK, but clearly email addresses got out at several points. At some point I stopped bothering to check. As for Soundcloud, the password I had saved for it and a tiny bit of profile information tells me a lot - a manually created password saved into a password manager, probably in 2010 or 2011 and unused after grabbing a single track. Addresses for services I actually care about also get what's basically peppering, and have all had updates much more recently than the days of Blackberry devices.
- 9mo ago
- al_borland 9mo agoI went through and deleted a bunch of accounts a while ago, SoundCloud being one of them. It looks like I don't show up in the breach. It's nice to know SoundCloud actually deleted my data, I'm never totally sure what happens on the backend.
- gleenn 9mo agoIn theory, it's a legal requirement based on GDPR and CCPA as well as many other new digital rights laws across Europe and many states in the USA. SoundCloud is probably big enough to do that correctly otherwise e.g. the GDPR penalty is a highish percentage of the company's total revenue which gives the laws a good amount of "teeth".
- Nextgrid 9mo ago> the GDPR penalty is a highish percentage of the company's total revenue which gives the laws a good amount of "teeth" Under 2% of GDPR complaints even result in fines. And that would require there to be grounds for a complaint - there's no way for an external user to tell whether the delete is actually done, and the DPA won't force them to submit to a third-party source code audit. The GDPR has zero teeth. But don't take it from me, these guys have a bit more expertise than I do on this subject: https://noyb.eu/en/data-protection-day-5-misconceptions-about-data-protection-debunked https://noyb.eu/en/data-protection-day-5-misconceptions-abou...
- gnabgib 9mo agoOnly 20% of accounts were breached, so that's an optimistic conclusion.
- Razengan 9mo agoFor some services, like Anthropic/Claude's stubborn refusal to let you remove your payment method, deleting isn't even an option.
- al_borland 9mo agoI ran into this with Sony. The website said to call, so I did. After 45 minutes on hold the guy just hung up on me saying he couldn’t help, without even really listening to me. For a company that’s been hacked as many times as Sony, I find this to be pretty pathetic.
- nalekberov 9mo agoGlad that I removed my SoundCloud account right on time. I think it’s only a matter of time before a service gets breached. It's best to use unique random username, email, and password for every online account. Also, providing only the bare minimum of data and faking as much as possible is helpful in cases of data breaches.
- direwolf20 9mo agoAn email–only breach seems to cheapen the value of HIBP. It's not telling me if my password was leaked.
- poglet 9mo agoPlus, the "Recommended Actions" only show me two sponsored products (1Password and Truyu) leaving me confused in what I'm supposed to do now.
- direwolf20 9mo agoIt's just advertising slop like any other now. No different from "your computer has a virus, buy our cleaner app"
- snorbleck 9mo agomaking mountains out of mole hills. this type of panic is really common in the infosec world.
- doodlesdev 9mo agoHow so? I tend to disagree with the general statement that this is common in the infosec world, but I'd like to understand better what you mean by that.
- vachina 9mo agoImpact in this case, is non-existent (Wow they got my email) > I'd like to understand better what you mean by that. Recall there was a period where every CPU sidechannel attack had a dedicated (wow) website and a rock band name assigned to it (when in reality their impact again, was/is limited).
- CaptainWeekend 9mo agoOh nice. Maybe I can finally recover (and finally shut down) my old account I accidentally locked myself out of.
- thinker1972 9mo agoPeople should be using email alias. 1 unique alias per 1 uniques service and websites for proper segregation. If any of the unique alias leaked or getting spammed you'd know where the source is and blocking that specific alias would limit the breach. Theres simplelogin.io, addy.io, firefox relay, apple hide-my-email, custom domain catchall etc for that.
- karlgkk 9mo agoIMO use email providers that have that built in. Because if your alias provider goes down, you’re fucked. And considering it’s a much less stable business than an email provider, it’s more likely. If Gmail goes down in 20 years, it will be a major occurrence. If mailgoforward.fart goes down, you’re screwed. The advice is, as always, use a second mail address for “sensitive” providers. Use a password manager and two factor for everything. Ideally one that integrates into your phone and browser. For traceability, most providers support a + alias syntax now. Ie foobar+baxservice@provider.com
- perching_aix 9mo agoI don't get why + addresses always come up in this. They're machine-undoable by design. Using randomized relay addresses instead gives you an immensely higher confidence that when a given contact address starts getting spam, it is misuse stemming from a specific entity. Especially if you rotate it at a fixed time interval, cause then you can even establish a starting timeframe. Still not perfect but it can never really be, and not even out of email's fault. As long as DNS and IP addressing rule the world, there's only so much one can do. Once identity is private-default, it becomes a secret handling problem at its core, a capability these schemes were never designed to provide.
- thinker1972 9mo agoI'd say for longevity and portability use own custom domain. Simplelogin, addy support using own custom domain. Its just $10-15 something per year. Most tld allowed max cumulative renewal up to 10 years so $100-150. Setup a yearly calendar reminder on January to renew +1 year so at any give time the domain will have minimum 9-10 years before expiring. If got hit by a bus tomorrow then 9 years should be long enough time for whatever accounts linked to the domain to rot and be useless for the next domain owner.
- jeremyken708 9mo ago[dead]