Suno’s 2025 Data Breach Exposed 55M Email Addresses, Payment Details, and AI Training Secrets In November 2025, AI music startup Suno suffered a supply-chain attack that compromised extensive user data and internal systems. The breach, which remained undisclosed for eight months, was confirmed on July 20, 2026, when breach monitoring service Have I Been Pwned listed 55.3 million unique email addresses tied to Suno’s systems. The attack originated from malware on a developer’s laptop, introduced via third-party code. The threat actor used stolen credentials to move laterally within Suno’s environment, accessing Stripe payment records, source code repositories, and user data. Exposed information included names, physical addresses, phone numbers, purchase histories, and partial payment card numbers with expiry dates. Suno initially downplayed the incident, claiming only "outdated source code" was affected a statement contradicted by TechCrunch and Mozilla Monitor. Beyond user data, the breach revealed Suno’s AI training pipeline, providing rare evidence for ongoing RIAA lawsuits. Leaked documentation detailed a large-scale scraping operation, including: - 113,879 hours of YouTube Music content - 152,162 tagged YouTube tracks - 62,117 Pond5 files - 12,287 Deezer tracks - 17,615 Genius lyrics - 19,514 IMSLP files Suno reportedly used Bright Data, a commercial proxy service, to bypass anti-bot protections while harvesting content. The company has previously argued its training practices fall under fair use, but the leaked code provides concrete evidence for copyright disputes. Despite the severity of the breach, Suno has not notified affected users. Independent services like Have I Been Pwned and Mozilla Monitor remain the primary sources of disclosure for those impacted.