Connect with us

Technology

SoundCloud data breach exposes 29.8 million user accounts

Published

on

SoundCloud data breach exposes 29.8 million user accounts

NEWYou can now listen to Fox News articles!

Hackers have exposed personal and contact information tied to SoundCloud accounts, with data breach notification service Have I Been Pwned reporting impacts to approximately 29.8 million users. The breach hit one of the world’s largest audio platforms and left many users locked out with error messages before the company confirmed the incident.

Founded in 2007, SoundCloud grew into an artist-first service hosting more than 400 million tracks from over 40 million creators. That scale made this incident especially concerning. SoundCloud said it detected unauthorized activity tied to an internal service dashboard and launched its incident response process. At the time, users reported 403 Forbidden errors, especially when connecting through VPNs.

Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

Advertisement

SoundCloud confirmed unauthorized activity after users reported access errors, triggering an internal incident response. (iStock)

What data was exposed in the SoundCloud breach

SoundCloud initially said attackers accessed limited data and did not touch passwords or financial information. The company said the exposed information matched what users already show publicly on profiles.

Later disclosures painted a much bigger picture.

According to Have I Been Pwned, attackers harvested data from approximately 29.8 million accounts. That data included:

  • Email addresses
  • Usernames and display names
  • Profile photos and avatars
  • Follower and following counts
  • Geographic locations, in some cases

While no passwords were taken, linking emails to public profiles creates real risk. That combination fuels phishing, impersonation and targeted scams.

Who is behind the attack

Security researchers tied the breach to ShinyHunters, a well-known extortion gang. Sources told BleepingComputer that the group attempted to extort SoundCloud following the data breach. SoundCloud later confirmed those claims. In a January update, the company said attackers made demands and launched email-flooding campaigns to harass users, employees and partners. ShinyHunters has also claimed responsibility for recent voice phishing attacks targeting single sign-on systems at Okta, Microsoft and Google. Those attacks targeted corporate SaaS accounts to steal data and extort.

Advertisement

Why this breach matters even without passwords

At first glance, this may sound less serious than breaches involving passwords or credit cards. That assumption can be dangerous. Email addresses tied to real profiles allow scammers to craft convincing messages. They can pose as SoundCloud, brands or even other creators. With follower counts and usernames, messages feel personal and believable. Once attackers gain trust, they push links, malware or fake login pages. That is often how larger account takeovers begin.

What SoundCloud users should expect next

SoundCloud has not said whether more details will be released. The company did confirm the attack and the extortion attempt, but it has not answered follow-up questions about the scope or internal controls. For users, the long-term risk comes from how widely this dataset spreads. Once published, exposed data rarely disappears. It circulates across forums, marketplaces and scam networks for years.

We reached out to SoundCloud for comment, and a representative told us, “We are aware that a threat actor group has published data online allegedly taken from our organization. Please know that our security team—supported by leading third-party cybersecurity experts—is actively reviewing the claim and published data.”

SoundCloud has said it has found no evidence that sensitive data, such as passwords or financial information, was accessed.

Ways to stay safe after the SoundCloud breach

If you have or had a SoundCloud account, now is the time to act. Even limited data exposure can lead to targeted scams if you ignore it.

Advertisement

1) Watch for phishing and impersonation emails

Scammers often move fast after a breach. Watch your inbox for messages that mention SoundCloud, music uploads, copyright issues or account warnings. Do not click links or open attachments from unexpected emails. When in doubt, go directly to the official website instead of using email links. Strong antivirus software adds another layer of protection here.

Nearly 29.8 million accounts had emails and public profile data harvested, raising concerns about phishing and impersonation. (Cyberguy.com)

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

2) Change your SoundCloud password anyway

Passwords were not exposed, but changing them is still smart. Create a new password that you do not use anywhere else. If remembering passwords feels impossible, consider using a password manager to generate and securely store strong passwords. This reduces the risk of reuse across platforms.

Advertisement

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

3) Turn on two-factor authentication

Two-factor authentication (2FA) adds a critical barrier if someone tries to access your account. Even if attackers guess or obtain a password later, they still need a second verification step. Enable 2FA anywhere SoundCloud or connected services offer it.

4) Lock down your email account 

Your email is the real target after most breaches. If someone gains access to it, they can reset passwords everywhere else. Use a strong, unique password for your email account and turn on two-factor authentication. Review recovery emails and phone numbers to make sure they still belong to you.

DATA BREACH EXPOSES 400,000 BANK CUSTOMERS’ INFO

Advertisement

5) Reduce your online data footprint

Attackers use breached emails to search data broker sites and social platforms for more details. The less data available, the harder you are to target. Consider a data removal service to limit how often your email and personal details appear across the web.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

6) Check your other accounts for suspicious activity

Attackers often reuse exposed email addresses to test logins across streaming services, social media and shopping accounts. Watch for password reset emails you did not request or login alerts from unfamiliar locations. If something looks off, act fast.

Advertisement

Security researchers linked the breach to the ShinyHunters extortion group, which later attempted to pressure SoundCloud for payment. (Thomas Trutschel/Photothek via Getty Images)

Kurt’s key takeaways

Data breaches no longer stay contained to one app or one moment in time. Even when attackers expose information that looks harmless, the fallout can last much longer. The SoundCloud breach shows how public profile data paired with private contact details creates real exposure. Staying alert, limiting data sharing and using strong security habits remain your best defense as breaches continue to escalate.

Have you checked which old or forgotten accounts still expose your email and could be putting you at risk right now? Let us know your thoughts by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter 

Advertisement

Copyright 2026 CyberGuy.com.  All rights reserved.

Technology

Backbone’s versatile pro controller is nearly matching its best price to date

Published

on

Backbone’s versatile pro controller is nearly matching its best price to date

Mobile gaming has come a long way over the course of the last decade or so, but we all know that smartphones simply can’t match the visceral, tactile feel you get while playing with a dedicated controller. Luckily, Backbone makes some excellent mobile options — including last year’s Backbone Pro, which is on sale at Amazon, Best Buy, and Target right now for $139.99 ($30 off), its second-best price to date.

In many ways, Backbone’s latest mobile controller is merely an updated take on what came before. The handheld device consists of two oblong halves with an extendable strip of plastic in the middle, allowing you to use it with Android devices and iPhone 15, 16, and 17 series phones. It plugs into your phone’s USB-C port and, once connected, you can game with two full-sized ALPs thumbsticks, a responsive D-pad, and A, B, X, and Y buttons. It also features two programmable back buttons, a 3.5mm headphone jack, better ergonomics than your phone, and averages up to 40 hours of battery life on a single charge.

The hardware is only part of the equation, though. Backbone’s intent with the Pro is for it to function as a more universal gamepad, and as such, the company’s software pulls together games from Apple Arcade, Netflix, Google Play, and other services into a singular app, allowing you to discover and launch games with little fuss. What’s more, you can use it to stream Xbox or PlayStation games — either from your console or the cloud —and connect it to a wealth of other devices via Bluetooth, including your PC, Steam Deck, and Apple devices like the iPad and Mac. Sure, the beefy controller looks a little awkward when you’re using it without a phone, but it’s a small price to pay for its added versatility.

Continue Reading

Technology

iPhone calendar spam invites are surging

Published

on

iPhone calendar spam invites are surging

NEWYou can now listen to Fox News articles!

You glance at your phone and see it. A calendar alert warns you that your iPhone is infected. Or that you won a prize. Or that your account will be locked. Your first thought might be panic. Your second step should be to pause.

Many Apple users are reporting a wave of fake calendar invites that appear out of nowhere. These alerts are not malware. However, they are a scam tactic. And they can quickly clutter your calendar with junk events and suspicious links. Let’s break down what is happening and how to fix it.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

How fake calendar invites get onto your iPhone

Here is the surprising part. Most of the time, no app is installed. Nothing comes through the App Store. You do not download anything obvious.

Advertisement

HOW TO STOP SPAM MAIL, POLITICAL TEXTS AND EMAIL SPAM FOR GOOD
 

Scammers are flooding Apple Calendar with spam subscriptions that trigger urgent alerts and phishing links. (Stanislav Kogiku/SOPA Images/LightRocket via Getty Images)

Instead, the problem often starts with a single tap. You might click a bad link in a message or on a website. That page can quietly prompt you to subscribe to a calendar. Once you tap approve, even by accident, the spam events begin to flow in.

Because it is a subscription, the alerts show up directly in your iOS notifications. Even if the related email lands in junk mail, the calendar event can still appear on your device. It feels invasive. But according to users discussing the issue on Reddit’s r/Apple forum, it usually does not mean your phone was hacked.

As one commenter put it, if scammers are using calendar events to reach you, they likely did not break into your device. They simply tricked you into subscribing. 

Advertisement

Why iPhone calendar spam alerts feel urgent and real

Scammers design these fake calendar invites to trigger panic fast. For example, one alert may claim your iPhone has a virus, while another promises a prize or warns that your account will be suspended. Instead of giving you time to think, the message pushes you to act immediately. As a result, many people tap before they pause.

However, that second click is where the real risk begins. In many cases, it redirects you to a phishing site that asks for passwords, credit card details or other personal information. Although the calendar alert itself is not malware, engaging with it can expose you to identity theft or financial fraud. In other words, the danger is not the notification. It is what happens next.

How to remove iPhone calendar spam invites

The good news is that removing the spam usually takes only a few steps.

Step 1: Check your subscribed calendars

  • Go to Settings
  • Scroll to the bottom and tap Apps
  • Click Calendar
  • Tap Calendar Accounts
  • Click Subscribed Calendars
  • Look for any subscription you do not recognize. Delete it.

That single action often stops the flood of alerts.

APPLE APP PASSWORD SCAM EMAIL WARNING
 

Fake iPhone calendar alerts may look like malware, but experts say they usually stem from unwanted subscriptions. (Jaap Arriens/NurPhoto via Getty Images)

Advertisement

Step 2: Remove the spam subscription inside the Calendar app

  • Open the Calendar app.
  • Tap the calendar icon at the bottom.
  • Find the suspicious subscription and tap the “i” next to it. Confirm it is junk and unsubscribe.

After you unsubscribe, you may still need to manually delete leftover events.

Step 3: Offload and reinstall the Calendar app

If the app continues to behave strangely, you can offload it.

Important note before you do this: Offloading the app removes the app itself but keeps your calendar data. Your events stored in iCloud, Google or other accounts remain intact. However, if you delete the app instead of offloading it, that can remove locally stored data. If your calendars are synced with iCloud or another account, your events will come back after reinstalling. Still, it is smart to confirm your calendars are syncing before making changes.

  • Go to Settings
  • Click General
  • Tap iPhone Storage
  • Click Calendar
  • Tap Offload App
  • Restart your phone
  • Then go back to Settings > General > iPhone Storage > Calendar and tap Reinstall App. You can also tap the Calendar icon on your Home Screen. If it shows a small cloud download symbol, tap it to reinstall.

Several users reported that this solved lingering issues.

FBI WARNS SENIORS ABOUT BILLION-DOLLAR SCAM DRAINING RETIREMENT FUNDS, EXPERT SAYS AI DRIVING IT
 

Apple users can stop calendar spam by deleting suspicious subscriptions in Settings and the Calendar app. (Gabby Jones/Bloomberg via Getty Images)

How to prevent calendar spam in the future

Advertisement

Now that your calendar is clean, the next step is prevention.

Here are smart habits that make a real difference:

  • Keep iOS updated so security patches stay current
  • Avoid tapping links in unexpected texts or pop-ups
  • Use strong antivirus software to block malicious websites and phishing links before they load. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
  • Never engage with alerts about prizes or infections
  • Consider a data removal service to limit how much of your personal information is exposed online. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
  • Review and remove unknown calendar subscriptions regularly

Why Apple users are frustrated

Many users point out that even when a spam invite lands in junk mail, the event can still appear on the calendar. That disconnect feels like a flaw in the system. Some argue Apple should tighten how calendar subscriptions work. Still, personal awareness goes a long way. Scammers rely on quick reactions. Slow down, verify and stay skeptical of urgency.

Kurt’s key takeaways

Fake iPhone calendar spam invites are annoying. They are disruptive. And they can feel alarming. However, in most cases, they are the result of a sneaky subscription, not a hacked phone. A few careful taps can remove them. A few smarter habits can keep them from returning.

The next time your phone flashes an urgent warning, will you react instantly or take a breath and investigate first? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading

Technology

Google Chrome is coming to Arm-powered Linux devices later this year

Published

on

Google Chrome is coming to Arm-powered Linux devices later this year

Why Arm + Linux now? In a blog post, Google only says that it “addresses the growing demand for a browsing experience that combines the benefits of the open-source Chromium project with the Google ecosystem of apps and features.” What we’re left wondering is whether Google’s talking about existing demand, or demand yet to come.

There’s certainly a growing demand for Linux. Some Verge editors have begun to ditch Windows with varying degrees of success. But those are our x86 desktops — there isn’t a lot of consumer-facing Linux on Arm chips, unless you count all the Linux-based Android phones out there. You can buy Linux on laptops from Dell, Lenovo, Framework, and such, but again, they use x86 chips. (And if you’re not a consumer, there’s already Chromium.)

But three of the companies that actually build Arm processors — Qualcomm, Nvidia, and Mediatek — may look to Linux as they try to compete with the Windows/Intel/AMD incumbents. Qualcomm told me in January that it sees “a lot of interest on other operating systems” beyond Windows for its PC-grade Arm chips. Nvidia could reveal its N1 and N1X processors for Arm laptops as soon as next week at its GTC 2026 developer conference.

While those Nvidia laptops might get announced with Windows, it wouldn’t be surprising if they targeted Linux too, once the basics like Chrome are sorted out. Google’s blog post specifically namedrops Nvidia’s DGX Spark as a target for Chrome — those $4,000+ beefy micro AI desktops, sold by a wide array of the company’s partners, also run Linux on Arm. Google says it’s putting Chrome into Nvidia’s package manager to make installation easier; everyone else will have to go to chrome.com/download when the browser arrives in Q2.

Continue Reading

Trending