Connect with us

Technology

SoundCloud data breach exposes 29.8 million user accounts

Published

on

SoundCloud data breach exposes 29.8 million user accounts

NEWYou can now listen to Fox News articles!

Hackers have exposed personal and contact information tied to SoundCloud accounts, with data breach notification service Have I Been Pwned reporting impacts to approximately 29.8 million users. The breach hit one of the world’s largest audio platforms and left many users locked out with error messages before the company confirmed the incident.

Founded in 2007, SoundCloud grew into an artist-first service hosting more than 400 million tracks from over 40 million creators. That scale made this incident especially concerning. SoundCloud said it detected unauthorized activity tied to an internal service dashboard and launched its incident response process. At the time, users reported 403 Forbidden errors, especially when connecting through VPNs.

Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

Advertisement

SoundCloud confirmed unauthorized activity after users reported access errors, triggering an internal incident response. (iStock)

What data was exposed in the SoundCloud breach

SoundCloud initially said attackers accessed limited data and did not touch passwords or financial information. The company said the exposed information matched what users already show publicly on profiles.

Later disclosures painted a much bigger picture.

According to Have I Been Pwned, attackers harvested data from approximately 29.8 million accounts. That data included:

  • Email addresses
  • Usernames and display names
  • Profile photos and avatars
  • Follower and following counts
  • Geographic locations, in some cases

While no passwords were taken, linking emails to public profiles creates real risk. That combination fuels phishing, impersonation and targeted scams.

Who is behind the attack

Security researchers tied the breach to ShinyHunters, a well-known extortion gang. Sources told BleepingComputer that the group attempted to extort SoundCloud following the data breach. SoundCloud later confirmed those claims. In a January update, the company said attackers made demands and launched email-flooding campaigns to harass users, employees and partners. ShinyHunters has also claimed responsibility for recent voice phishing attacks targeting single sign-on systems at Okta, Microsoft and Google. Those attacks targeted corporate SaaS accounts to steal data and extort.

Advertisement

Why this breach matters even without passwords

At first glance, this may sound less serious than breaches involving passwords or credit cards. That assumption can be dangerous. Email addresses tied to real profiles allow scammers to craft convincing messages. They can pose as SoundCloud, brands or even other creators. With follower counts and usernames, messages feel personal and believable. Once attackers gain trust, they push links, malware or fake login pages. That is often how larger account takeovers begin.

What SoundCloud users should expect next

SoundCloud has not said whether more details will be released. The company did confirm the attack and the extortion attempt, but it has not answered follow-up questions about the scope or internal controls. For users, the long-term risk comes from how widely this dataset spreads. Once published, exposed data rarely disappears. It circulates across forums, marketplaces and scam networks for years.

We reached out to SoundCloud for comment, and a representative told us, “We are aware that a threat actor group has published data online allegedly taken from our organization. Please know that our security team—supported by leading third-party cybersecurity experts—is actively reviewing the claim and published data.”

SoundCloud has said it has found no evidence that sensitive data, such as passwords or financial information, was accessed.

Ways to stay safe after the SoundCloud breach

If you have or had a SoundCloud account, now is the time to act. Even limited data exposure can lead to targeted scams if you ignore it.

Advertisement

1) Watch for phishing and impersonation emails

Scammers often move fast after a breach. Watch your inbox for messages that mention SoundCloud, music uploads, copyright issues or account warnings. Do not click links or open attachments from unexpected emails. When in doubt, go directly to the official website instead of using email links. Strong antivirus software adds another layer of protection here.

Nearly 29.8 million accounts had emails and public profile data harvested, raising concerns about phishing and impersonation. (Cyberguy.com)

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

2) Change your SoundCloud password anyway

Passwords were not exposed, but changing them is still smart. Create a new password that you do not use anywhere else. If remembering passwords feels impossible, consider using a password manager to generate and securely store strong passwords. This reduces the risk of reuse across platforms.

Advertisement

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

3) Turn on two-factor authentication

Two-factor authentication (2FA) adds a critical barrier if someone tries to access your account. Even if attackers guess or obtain a password later, they still need a second verification step. Enable 2FA anywhere SoundCloud or connected services offer it.

4) Lock down your email account 

Your email is the real target after most breaches. If someone gains access to it, they can reset passwords everywhere else. Use a strong, unique password for your email account and turn on two-factor authentication. Review recovery emails and phone numbers to make sure they still belong to you.

DATA BREACH EXPOSES 400,000 BANK CUSTOMERS’ INFO

Advertisement

5) Reduce your online data footprint

Attackers use breached emails to search data broker sites and social platforms for more details. The less data available, the harder you are to target. Consider a data removal service to limit how often your email and personal details appear across the web.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

6) Check your other accounts for suspicious activity

Attackers often reuse exposed email addresses to test logins across streaming services, social media and shopping accounts. Watch for password reset emails you did not request or login alerts from unfamiliar locations. If something looks off, act fast.

Advertisement

Security researchers linked the breach to the ShinyHunters extortion group, which later attempted to pressure SoundCloud for payment. (Thomas Trutschel/Photothek via Getty Images)

Kurt’s key takeaways

Data breaches no longer stay contained to one app or one moment in time. Even when attackers expose information that looks harmless, the fallout can last much longer. The SoundCloud breach shows how public profile data paired with private contact details creates real exposure. Staying alert, limiting data sharing and using strong security habits remain your best defense as breaches continue to escalate.

Have you checked which old or forgotten accounts still expose your email and could be putting you at risk right now? Let us know your thoughts by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

Advertisement

Copyright 2026 CyberGuy.com.  All rights reserved.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Android 17’s new foldable gaming mode could make flippy phones more fun

Published

on

Android 17’s new foldable gaming mode could make flippy phones more fun

Android 17 is getting a dedicated gaming mode for foldables that will put a virtual gamepad with touch controls on half of your screen to theoretically make it easier to play games.

With foldable gaming mode, which is set to launch in the coming months, the virtual controller emulates physical button presses at a system level and is designed to work “with any game that supports physical controllers,” says Google’s Mishaal Rahman on Reddit. For the actual inputs, the virtual controller will have a D-pad; left and right virtual sticks; A, B, X, and Y buttons; L1, L2, L3; R1, R2, and R3; and a start button. And you’ll be able to configure the gamepad in several ways, such as keeping the virtual joysticks inline or staggered from each other, scaling the size of the buttons, and toggling haptics on or off.

Turning on the mode “is as simple as unfolding your device, either before or after launching a compatible game,” Rahman says. You can also choose to hide the gamepad, and if you connect a physical controller, the virtual gamepad will turn off on its own.

“Android allows you to play a wide variety of games on the go,” says Rahman. “While touch controls work incredibly well for many titles, certain games are better enjoyed with physical gamepads. The problem is that carrying a Bluetooth controller or a snap-on gamepad with you everywhere isn’t always convenient. We want to bridge that gap, and we’re addressing it with a new feature in the Android 17 platform release that’s specifically tailored for foldable devices.”

Continue Reading

Technology

Debt collection letter for debt you don’t owe? What to do now

Published

on

Debt collection letter for debt you don’t owe? What to do now

NEWYou can now listen to Fox News articles!

A letter arrives about a debt you don’t remember, from a company you’ve never dealt with, for an account you never opened. For a growing number of people, that notice is how they first learn someone used their identity.

Complaints to the Consumer Financial Protection Bureau (CFPB) about attempts to collect a debt not owed rose about 115% above their prior two-year average in 2025, and many of those consumers reported balances they didn’t recognize and suspected identity theft.

Before you panic or pay, it helps to understand why these letters show up and what rights you have.

WHY LAST YEAR’S BREACH IS THIS YEAR’S IDENTITY FRAUD

Advertisement

A collection letter for a debt you do not recognize can be the first sign that someone used your identity. (John Carl D’Annibale /Albany Times Union via Getty Images)

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.  

Why debt collectors contact you about a debt you do not owe

When a charged-off account is sold to a collection agency, the agency receives the original creditor’s application file, including whatever identifiers were used to open it. That contact information is often 90 to 180 days out of date by the time the account changes hands.

HOW SCAMMERS BUILD A PROFILE ON YOU USING DATA BROKERS

Before the first call, the agency runs skip tracing: matching a name, Social Security number (SSN) and past addresses against public records, postal change-of-address data, property and utility records and data-broker files to find the current person behind the account. At bulk volume, each lookup costs the agency pennies.

Advertisement

The agency then contacts you directly, by phone or mail, whether or not you have looked at your credit file.

How fake debt can start with identity theft

The account behind the notice may have been opened with your information pulled from breaches and resold, then approved by an automated check that matched the data to an existing file without confirming that the applicant was you. Opening a new account is the leading form of attempted identity misuse reported to the Identity Theft Resource Center (ITRC), which counted it more often than takeovers of accounts people already held. What happens after is less understood.

10 SIGNS YOUR PERSONAL DATA IS BEING SOLD ONLINE

Charged-off debts, including fraudulent ones, are sold in bulk portfolios for pennies on the dollar, often with thin supporting paperwork. One fraudulent balance can be sold and resold across several agencies. A debt you dispute and clear with one collector can be repackaged and reappear with another months later.

With medical debt, a bill can sometimes move toward collections before you see every explanation of benefits, insurance update or corrected statement. That is why you should contact the provider and your insurer before paying a collector.

Advertisement

What debt collectors legally have to tell you

Federal law gives you a defined response, and the clock starts at first contact. Under the CFPB’s Regulation F, a collector must send a validation notice describing the debt and your rights in, or within five days of, its first communication with you.

5 MYTHS ABOUT IDENTITY THEFT THAT PUT YOUR DATA AT RISK

You have 30 days from receiving that notice to dispute the debt in writing under the Fair Debt Collection Practices Act (FDCPA). Dispute inside that window, and the collector must stop collecting until it verifies the debt.

One important note: the FDCPA generally covers third-party debt collectors, not every original creditor. However, credit reporting laws, identity theft protections and state laws may still give you rights.

If the debt came from identity theft, send the collector an FTC Identity Theft Report from IdentityTheft.gov. Also, tell the collector in writing that you dispute the debt, that it resulted from identity theft and that you want it to stop reporting the account to the credit bureaus.

Advertisement

IS YOUR SOCIAL SECURITY NUMBER AT RISK? SIGNS SOMEONE MIGHT BE STEALING IT

Ask Equifax, Experian and TransUnion for a block under Section 605B of the Fair Credit Reporting Act (FCRA).

With a valid identity theft report and proof of your identity, the bureaus must block the fraudulent item within four business days. A block is harder to reverse than an ordinary dispute, which counts when the same debt can be resold.

The CFPB has said it may expand the meaning of identity theft under Regulation V to cover “coerced debt,” money run up in someone’s name without their consent, including in domestic and elder abuse cases.

What to do before you pay a debt collector

Before you send money or confirm any personal details, slow down and make the collector prove the debt belongs to you.

Advertisement

1) Ask for proof in writing

Do not pay, promise to pay or give out more personal information during the first call. Ask for the validation notice in writing and save every letter, voicemail and call log. Then send a written dispute within 30 days.

Fake debts can start with stolen personal information and then move from one collection agency to another. (PixelsEffect/Getty Images)

 

2) File an identity theft report if the debt looks fake

If you believe identity theft caused the account, create an FTC Identity Theft Report at IdentityTheft.gov. Send copies to the collector, the original creditor and all three credit bureaus. Also, place a fraud alert or credit freeze with Equifax, Experian and TransUnion, so it becomes harder for someone to open another account in your name.

3) Check medical bills before paying a collector

With medical debt, contact the provider and your insurer before paying a collector. Ask for an itemized bill and an explanation of benefits. A medical bill can end up in collections while paperwork, insurance reviews or billing disputes are still catching up.

4) Respond quickly if a collector sues you

If a collector sues you, do not ignore the papers. Respond by the court deadline or contact a consumer law attorney or legal aid group. Even a debt you do not owe can create bigger problems if you miss a court deadline.

Advertisement

Why early fraud alerts can save you money

Once a fraudulent account charges off and sells, cleanup gets harder. You may need to dispute the debt with the collector, the original lender and all three credit bureaus. If someone resells the debt, the same problem can come back months later.

YOU HAVE A CREDIT FREEZE. IT STILL ISN’T ENOUGH

Credit monitoring can help you spot a new account or hard inquiry before the debt reaches collections. That gives you time to contact the lender, dispute the account and freeze your credit sooner.

No service can prevent every account opened in your name. However, three-bureau credit monitoring can alert you when lenders report new accounts or hard inquiries. That can help you act before a collections notice arrives or a lender denies you credit.

See my tips and best picks on Best Identity Theft Protection at CyberGuy.com.

Advertisement

Kurt’s key takeaways

A collection letter for an unfamiliar debt deserves a closer look. It may mean someone opened an account in your name. Do not pay just to stop the calls. Ask for written validation and dispute the debt fast. If someone misused your information, file an FTC Identity Theft Report. Then freeze your credit and check all three credit reports. Early alerts can help you catch fraud before collections begin. That can save you money, time and stress.

Have you ever gotten a collection letter or call for a debt you knew you did not owe, and what did you do first? Let us know by writing to us at CyberGuy.com.

Before paying a collector, ask for written proof, dispute the debt and file an FTC Identity Theft Report if fraud is involved. (Daniel de la Hoz/Getty Images)

Sign up for my FREE CyberGuy Report

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Advertisement
  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.  

Continue Reading

Technology

Here’s a bunch of Prime Day deals on keyboards, mice, and other peripherals we like

Published

on

Here’s a bunch of Prime Day deals on keyboards, mice, and other peripherals we like

RAMageddon has come for computers. The price of memory chips, hard drives, and solid state storage has skyrocketed. That’s led to price increases on desktop and laptop RAM, SSDs, spinning hard drives, and pretty much everything that uses any of those things. Consoles are more expensive. Desktops are more expensive. Laptops are more expensive. Tablets and phones are more expensive. Even MacBooks, which started out expensive but then started looking like a pretty good deal, just got more expensive.

All that sucks. But if (if) there’s a silver lining, it’s that most of the stuff you plug into a computer — keyboards, mice, webcams, monitors, and so forth — isn’t getting bananas expensive. Actually, there are some good deals out there.

Great keyboards on the cheap

Hot deals on mice in your area

Monitors to watch (get it?)

Advertisement

Cases and stands, hubs and docks, and other stuff

Continue Reading
Advertisement

Trending