SoundCloud Data Breach Lawsuit: 29.8 Million Accounts, No Settlement Yet
Active Litigation
In December 2025 SoundCloud disclosed that it had detected unauthorized activity in an ancillary service dashboard; the data involved was email addresses and information already visible on public profiles, for about 20% of its users. Have I Been Pwned counts 29.8 million affected addresses. Three class actions are now one case in Manhattan federal court, and SoundCloud has moved to dismiss it. As of October 18, 2026 there is no settlement, no claim form and no deadline.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened and What the Lawsuit Says
On December 15, 2025 SoundCloud said it had detected unauthorized activity in an “ancillary service dashboard,” contained it, and brought in outside cybersecurity experts. It said denial-of-service attacks followed, two of which temporarily disabled the platform on the web only.
SoundCloud's position, repeated in every update: the data involved was email addresses and information already visible on public profiles, for about 20% of users — no passwords and no payment data. Have I Been Pwned lists email addresses, names, usernames, avatars, follower and following counts and, for some users, country. It says the attackers tried to extort SoundCloud and then released the data publicly.
The soundcloud lawsuit alleges that SoundCloud failed to use reasonable security, that a hacking group stole information from more than 29.8 million accounts, and that users now face phishing and identity-theft risk. The original complaint pleads negligence, breach of implied contract, unjust enrichment and declaratory judgment. SoundCloud has not conceded any of this.
Case details
The lead case is Merkel v. SoundCloud Inc., No. 1:26-cv-00980, filed February 4, 2026 in the U.S. District Court for the Southern District of New York, assigned to Judge Jennifer H. Rearden. On April 1, 2026 Magistrate Judge Henry J. Ricardo consolidated it with Ghanaat v. SoundCloud, Inc., No. 26-CV-1093, and Murphy v. SoundCloud, Inc., No. 26-CV-1169. All filings now go on the 26-CV-980 docket. The same order denied, without prejudice, a request to appoint interim lead counsel. The court record is public on CourtListener.
Status: Motion to Dismiss Pending, No Settlement
There is no settlement, no fund, no administrator, no claim form and no deadline. The motion is the next real decision point: if granted, the case could end or be narrowed; if denied, it moves into discovery. The core dispute is whether exposing emails linked to otherwise-public profiles is a legal injury at all.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Would Be in the Class
The original complaint seeks to represent, per published summaries, all individuals in the United States whose personal information was compromised in the SoundCloud data breach. No class has been certified, and there is nothing to sign up for.
How to check: enter your email address at Have I Been Pwned, which added the SoundCloud data on January 27, 2026. A hit means that address is in the leaked set. Screenshot the result and keep any SoundCloud email about the incident. If a settlement ever comes, a court-appointed administrator gives notice to class members.
Will There Be Money?
Be realistic about the data. By SoundCloud's account, and by Have I Been Pwned's list, the leak involved emails, names, usernames and profile details — not Social Security numbers, passwords or card numbers. Breach cases without those fields tend to be harder to win, and when they settle the per-person amounts are usually small, especially across a class of tens of millions. Any figure you see advertised now is a guess. Our data breach settlement calculator shows what comparable resolved cases paid.
How cases like this one end
Our copy of the federal courts’ own case database covers 25,309 other fraud casesclosed in U.S. federal district courts between 2015 and 2026, 27.6% of them filed as class actions:
- 17.1% ended in a settlement recorded by the court. Another 22.9% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 17.1% and 39.9%.
- 10.2% were decided on a motion before any trial.
- 1 in 112 reached a trial (0.9%), after a median of 29.9 months.
- Median time from filing to the end of the case: 7 months.
- Only 761 of them (3%) record a money award at all; the median of those is $663,000.
These are base rates for this type of case (federal other fraud cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
SoundCloud Data Breach Timeline
December 15, 2025 — SoundCloud Discloses the Incident
SoundCloud reports unauthorized activity in an internal dashboard, says it affected about 20% of users, and says no password or financial data was accessed.
January 13, 2026 — Extortion and Email Flooding
SoundCloud says the group claiming responsibility made demands and flooded users, employees and partners with emails. It says it is working with authorities.
January 27, 2026 — Data Indexed by Have I Been Pwned
Have I Been Pwned adds the breach: 29.8 million affected addresses. Anyone can now check whether their email is included.
February 4, 2026 — First Class Action Filed
Merkel v. SoundCloud Inc., No. 1:26-cv-00980, is filed in the Southern District of New York. Two more suits follow. SoundCloud posts its final update on February 24, 2026.
April 1, 2026 — Three Cases Consolidated
The court combines Merkel, Ghanaat and Murphy. A consolidated complaint follows on May 18, 2026.
July–August 2026 — Motion to Dismiss Fully Briefed
SoundCloud moves to dismiss on July 2, 2026; briefing closes August 21, 2026. As of October 18, 2026 no ruling appears on the docket and no settlement exists.
Three Things to Watch For
This leak is mostly a list of email addresses tied to real usernames — exactly what phishing needs:
Fake “SoundCloud security” emails asking you to log in
SoundCloud says it will never ask for your password or credentials. A message quoting your real username and urging you to “verify your account” through a link is the predictable follow-up to this leak. Go to the app directly instead.
“Claim your SoundCloud settlement” sites
There is no settlement and no claims portal as of October 18, 2026. A page asking for your login, bank details or a fee to “secure your payment” is collecting data, not filing anything.
Messages claiming more was stolen
SoundCloud says the group behind the attack keeps claiming sensitive data was taken, and that no evidence supports those claims. Treat “we have your private files, pay us” emails as extortion bait: do not reply or pay.
SoundCloud Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
What is going on with SoundCloud right now?
As of October 18, 2026, SoundCloud is defending a consolidated data breach class action in New York federal court, Merkel v. SoundCloud Inc., No. 1:26-cv-00980. Its motion to dismiss was fully briefed on August 21, 2026 and no ruling appears on the docket yet. SoundCloud posted its final incident update on February 24, 2026, saying its outside investigation was complete.
Is there a SoundCloud data breach settlement or claim form?
No. There is no settlement, no fund, no administrator, no claim form and no deadline. If one is ever approved, class members get official notice from a court-appointed administrator.
How do I know if my account was in the SoundCloud data breach?
Search your email at Have I Been Pwned, which lists 29.8 million affected addresses from this breach. SoundCloud said about 20% of its users were affected.
What data was exposed?
SoundCloud says only email addresses and information already visible on public profiles — no passwords or financial data. Have I Been Pwned lists email addresses, names, usernames, avatars, follower and following counts and, in some cases, country. The lawsuit alleges broader exposure; that is a claim, not a finding.
Is SoundCloud a safe site?
SoundCloud says the incident was contained, that its third-party investigation is complete, and that it strengthened monitoring, access controls and DDoS defenses. The practical risk from this leak is phishing aimed at your email address, so use a unique password and turn on two-factor authentication.
Do I need to join the soundcloud lawsuit?
No. Under Rule 23, if a class is certified or a settlement approved, you are included automatically unless you opt out by the deadline in the official notice. Nothing needs to be signed now.
Should I delete my SoundCloud account?
Deleting it now does not pull back data that has already leaked, and it does not affect whether you would be a class member. Changing your password and watching for phishing does more. Keep a record (such as a Have I Been Pwned screenshot) whatever you decide.
Who hacked SoundCloud?
The lawsuit and news reports name a known extortion group; SoundCloud has only said a “purported threat actor group” was responsible and that it is working with authorities. This page does not name the attackers.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements you can file a claim in right now, with deadlines
- Data Breach Settlement CalculatorWhat comparable data breach settlements have paid per person
- Settlement Payout CalculatorEstimate a per-person share from fund size and claim rates
- Canvas Data Breach LawsuitAnother 2026 data breach case and where it stands