# SoundCloud Breach Exposes 28 Million… | Dynamoi News

Canonical URL: https://dynamoi.com/news/2025-12-16-soundcloud-breach-exposes-28-million-accounts-in-shinyhunter.html

Source: Dynamoi static public site

Description: Retaliatory DoS attacks and a controversial VPN blockade are disrupting A&R workflows and global artist access following the massive leak.

Dynamoi News SoundCloud Breach Exposes 28 Million Accounts in ShinyHunters Attack Retaliatory DoS attacks and a controversial VPN blockade are disrupting A&R workflows and global artist access following the massive leak. Published December 16, 2025 Editor Trevor Loucks Editorial policy → SoundCloud has confirmed a massive security breach affecting nearly 20% of its user base, exposing the email addresses and profile data of approximately 28 million accounts. While the Berlin-based platform has contained the initial intrusion, the fallout has triggered a chaotic chain of operational disruptions that are headache-inducing for digital strategists and artist managers. As of Tuesday, December 16, 2025, the service is battling on two fronts: securing the compromised data and mitigating retaliatory Denial of Service (DoS) attacks. For the music industry, this isn't just a tech story; it is a wake-up call regarding the fragility of the digital supply chain that powers A&R discovery and demo sharing. Inside the 28 million figure The breach did not occur through the main consumer app, but via an "ancillary service dashboard"—a secondary internal system likely used for analytics or operations. While technical teams might appreciate the distinction, the scale of the leak is significant. Here is the damage report: The scope: 20% of active users, translating to roughly 28 million accounts. The exposure: Email addresses and public profile data are in the wild. The silver lining: SoundCloud states that passwords, financial details, and biometric data remain secure. Key insight: The compromised data is limited to contact info, but in the music business, an artist's email is a gateway key. The real risk now is not direct account theft, but highly targeted social engineering. ShinyHunters vs. The Dashboard Although SoundCloud officially attributes the attack to a "purported threat actor group," security analysts have linked the intrusion to ShinyHunters . This cyber-extortion gang specializes in harvesting databases from digital platforms to hold them for ransom. The entry point serves as a critical lesson for label operations leads: the "ancillary dashboard" vulnerability proves that a platform is only as secure as its least-monitored internal tool. When evaluating tech partnerships, executives must scrutinize the security of the entire ecosystem, not just the consumer-facing frontend. The 403 error fallout In a defensive maneuver to stop the data exfiltration, SoundCloud implemented aggressive configuration changes that blocked Virtual Private Network (VPN) access. This decision prioritized system integrity over connectivity, but the cost was immediate global fragmentation. The disruption: Users relying on VPNs began hitting HTTP 403 errors starting December 13. The geography: This effectively cut off legitimate users in territories like Russia, Turkey, and mainland China where VPNs are essential for access. The volatility: Even after the breach was contained, retaliatory DoS attacks temporarily disabled the web interface, forcing A&Rs to rely on mobile apps and APIs which remained stable. Protecting the digital supply chain For managers and label reps, the immediate threat is "phishing migration." Threat actors often use fresh databases to craft convincing emails—posing as royalty collection societies or DSP support—to steal credentials for higher-value targets like Spotify for Artists or bank accounts. The risk: Managers often reuse passwords or fail to enable Multi-Factor Authentication (MFA) on demo accounts. The fix: Assume every SoundCloud-associated email is public. Rotate passwords immediately if they were reused elsewhere, and enforce MFA across your roster's entire digital footprint. Furthermore, this instability may accelerate the industry's shift away from using SoundCloud for private pre-release assets, pushing sensitive content toward dedicated B2B tools like Disco or Box. Related stories Jury Rules Live Nation an Illegal Monopoly as States Push Breakup May 9, 2026 Apple Inks $500M Generative AI Training Pact With Warner Music May 9, 2026 Create Music Group Finances AI Artist Roster in Multi-Million JV February 5, 2026 Kobalt and Madverse Deal Unlocks Royalties for 150,000 Indian Artists January 18, 2026 Latest News May 30, 2026 Warner Music Settles $24M Copyright Suit With Crumbl May 29, 2026 UMG Board Unanimously Rejects Bill Ackman’s $64B Takeover Bid May 29, 2026 Spotify Rolls Out $10.99 Basic Tier Amid $150M Royalties Dispute May 28, 2026 Sony Weaponizes 2024 AI Opt-Out in 61,000-Track Suno Lawsuit May 27, 2026 33 States Demand Ticketmaster Divestiture After Antitrust Verdict May 26, 2026 Spotify Shares Surge 16% on UMG Deal for Paid AI Remix Tools See pricing →