Over the last few days, SoundCloud users have reported being unable to connect to the platform and having VPN connection issues.
Now, in a statement on its website, the service has confirmed a cyber incident, adding that threat actors gained access to and exfiltrated data.
“SoundCloud recently detected unauthorised activity in an ancillary service dashboard. Upon making this discovery, we immediately activated our incident response protocols and promptly contained the activity,” the company said on its site.
SoundCloud added that after it contained the incident, it suffered a number of denial-of-service (DoS) attacks, two of which took down the website, preventing customers from accessing it.
Regarding stolen data, SoundCloud said the breach impacted roughly one in five users, but added that no sensitive data was stolen.
“We understand that a purported threat actor group accessed certain limited data that we hold,” SoundCloud said.
“We have completed an investigation into the data that was impacted, and no sensitive data (such as financial or password data) has been accessed.
“The data involved consisted only of email addresses and information already visible on public SoundCloud profiles and affected approximately 20 per cent of SoundCloud users.
“We are confident that any access to SoundCloud data has been curtailed.”
While SoundCloud did not attribute the attack to a threat group, it says it has been working with third-party cyber security professionals and has engaged its incident response protocols.
It has also bolstered some of its security systems, which it said caused the VPN connectivity issues.
“We are actively working to resolve these VPN related access issues,” it said.
Who is the threat actor?
While the hacker behind the incident is still unconfirmed, sources speaking with security publication BleepingComputer have suggested that the infamous ShinyHunters group is to blame.
The source told the publication that ShinyHunters is currently extorting SoundCloud after claiming to have exfiltrated a database with user information.
Believed to have formed in 2020, ShinyHunters is a financially motivated extortion actor known for targeting large businesses and publicly calling them out. Initially, the group had a strong presence on the well-known hacking forum BreachForums, but in recent times shifted to forming a supergroup alongside the notorious bogeyman of cyber crime, Scattered Spider, as well as Lapsus$ ransomware.
However, the group seems to be operating on its own once again, most recently claiming a cyber attack impacting PornHub and OpenAI.
Daniel Croft