SoundCloud Data Breach Lawsuit Says Details of Nearly 30M Users Exposed in Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

SoundCloud faces a proposed class action lawsuit that claims the music streaming platform failed safeguard the private information of users and employees, leading to a data breach that reportedly impacted more than 29.8 million accounts.

Want to stay in the loop on class action lawsuits that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

The 34-page data breach lawsuit contends that the cyber incident discovered by SoundCloud in December 2025 was the “direct and proximate result” of the music platform’s negligent failure to implement and follow basic cybersecurity procedures.

According to the suit, the SoundCloud data breach exposed a wealth of personally identifiable information (PII) to the hacker group behind the cyberattack, known as ShinyHunters. The exposed information included names, email addresses, contact details, geographic locations, profile statistics and login details, the filing says.

The case argues that consumers and employees who handed over their personal information to access SoundCloud’s services expected that the data would be protected and disclosed only in authorized, necessary circumstances. The lawsuit says that SoundCloud recklessly failed to implement standard cybersecurity measures and, in doing so, ultimately enabled unauthorized parties to access the data.

“Based on the value of Plaintiff’s and Class Members’ PII to cybercriminals, SoundCloud knew or should have known the importance of safeguarding the PII entrusted to it and of the foreseeable consequences if its data security systems were breached,” the case states.

According to the complaint, Soundcloud’s lack of data security protections constitutes a violation of the Federal Trade Commission Act as the company allegedly engaged in “unfair or deceptive acts or practices” in its failure to comply with industry-standard security measures, including failing to timely report the breach.

The plaintiff, a California resident, claims to have suffered actual injury as a result of the SoundCloud data breach, including lost time engaging in mitigation efforts, the now-diminished value of his privacy, and fear that the information might be used for nefarious purposes or posted on the dark web.

“Once Private Information is stolen, fraudulent use of that information and damage to victims may continue for years,” the case emphasizes.

On December 15, 2025, SoundCloud posted a statement to its newsroom in which it confirmed the breach but assured that no sensitive data, like financial or password information, was compromised, stating that the compromised data included only information already publicly visible on about 20 percent of the platform’s accounts. The company added to the post on January 13, reaffirming that no sensitive data was taken and that the company would be taking steps to reinforce its cybersecurity defenses.

The SoundCloud data breach class action lawsuit looks to represent all individuals in the United States whose personal information was compromised in the SoundCloud data breach.

Check out ClassAction.org’s lawsuit list for current class action lawsuits.