SoundCloud Data Breach Lawsuit, 30 Million Users Exposed, How to Join the Class Action and Claim Compensation

A proposed class action lawsuit filed February 4, 2026, alleges SoundCloud failed to protect nearly 30 million users’ personal information from the hacker group ShinyHunters in a cyberattack discovered December 2025. The breach exposed email addresses, usernames, geographic locations, and profile data to cybercriminals who later publicly released the stolen information after attempting to extort the music streaming platform.

What Happened in the SoundCloud Data Breach

SoundCloud discovered unauthorized activity in December 2025 when hackers accessed an ancillary service dashboard. According to the lawsuit filed in U.S. District Court for the Southern District of New York, the breach affected approximately 29.8 million accounts—roughly 20% of SoundCloud’s total user base.

The compromised data included names, email addresses, usernames, avatars, follower and following counts, and in some cases, geographic location information. ShinyHunters, the cybercriminal group responsible, mapped private email addresses to publicly visible profile information at scale, then attempted to extort SoundCloud before publicly releasing the dataset in January 2026.

SoundCloud confirmed the breach on December 15, 2025, stating no sensitive data like financial information or passwords was compromised. The company updated its statement January 13, 2026, reaffirming no payment data was accessed and pledging to reinforce cybersecurity defenses.

Who Was Affected by the SoundCloud Breach

You may be affected if you had a SoundCloud account at any time and your email address was linked to profile information. The breach impacted users across the United States whose data was processed through SoundCloud’s systems between July and December 2025.

Check if your information was exposed by visiting Have I Been Pwned and entering your email address. The database added SoundCloud breach data in January 2026. Alternatively, if you received a data breach notification letter from SoundCloud, your information was definitely compromised.

The SoundCloud Class Action Lawsuit Details

Plaintiff Alexander Merkel filed the lawsuit against SoundCloud Inc. on February 4, 2026, alleging negligence, negligence per se, and violations of the Federal Trade Commission Act. The complaint claims SoundCloud “recklessly failed to implement standard cybersecurity measures,” enabling unauthorized access to user data.

According to court documents, SoundCloud allegedly violated FTC guidelines requiring businesses to properly dispose of personal information, encrypt stored data, understand network vulnerabilities, and implement policies to correct security problems. The lawsuit states the compromised information was unencrypted and unredacted.

The proposed class seeks to represent all U.S. residents whose personal information was compromised in the December 2025 SoundCloud data breach. Similar data breach class action lawsuits like conduent have resulted in significant settlements for affected consumers.

What Information Was Exposed

Unlike password or credit card data breaches, the SoundCloud incident exposed information that creates phishing and identity theft risks. When email addresses are mapped to profile identities, cybercriminals can craft convincing targeted scams appearing to come from legitimate sources.

The exposed data included email addresses (30 million unique addresses), names and usernames, profile avatars and images, follower and following statistics, and geographic location data for some users.

While passwords and payment information weren’t compromised, security experts warn this type of exposure significantly increases phishing, impersonation, and targeted scam risks—especially for creators whose careers depend on trust and community.

How to Protect Yourself After the Breach

If your data was exposed, take these immediate steps. Change passwords on any accounts where you reused your SoundCloud password. Enable two-factor authentication on all important accounts. Monitor your email for suspicious phishing attempts referencing your SoundCloud profile.

Place fraud alerts on your credit reports by contacting Equifax, Experian, or TransUnion. Review financial statements for unauthorized charges. Watch for unexpected password reset requests on other services you use.

Consider enrolling in credit monitoring services—many class action settlements like webtpa-data-breach provide free monitoring to affected individuals as part of the resolution.

How Do I Join the SoundCloud Lawsuit

You typically don’t need to take action to join when class action lawsuits are initially filed. If you received a SoundCloud breach notification or your email appears in the Have I Been Pwned database for this incident, you’re likely automatically included if the court certifies the class.

Save your breach notification letter and document any fraud or identity theft you experience. Keep records of time spent addressing the breach and any out-of-pocket expenses for credit monitoring or identity protection.

Law firms including Scott+Scott Attorneys at Law LLP are investigating claims. Contact them if you want to actively participate or have questions about your eligibility.

What Compensation Could You Receive

While no settlement has been reached, similar data breach class actions provide context. Recent settlements have awarded between $2,500-$7,500 per person for documented losses, with additional pro-rata payments from settlement funds for all class members.

Potential compensation could include reimbursement for credit monitoring expenses, identity theft protection costs, documented financial losses from fraud, and time spent mitigating breach-related issues. Courts increasingly recognize that even breaches without password exposure cause real harm requiring compensation.

Last Updated: February 7, 2026

Disclaimer: This article provides general information about the SoundCloud data breach lawsuit and is not legal advice. For specific guidance about your eligibility or claim, consult a qualified attorney.

Stay informed, stay protected. — AllAboutLawyer.com

About the Author

Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah