Suno AI Music Platform Suffers Massive Data Breach, Exposing 55.3 Million Records In November 2025, AI music generator Suno fell victim to a cyberattack that resulted in the theft of personal data belonging to over 55.3 million users, a breach only revealed this week by breach notification service Have I Been Pwned. The stolen dataset includes names, physical and email addresses, phone numbers, purchase records, and partial payment card details including card types, expiry dates, and the last four digits linked to Suno’s Stripe account. Beyond customer data, the hacker also exfiltrated Suno’s source code, which reportedly documents how the company scraped songs and lyrics from platforms like Deezer, Genius, and YouTube to train its AI models. This revelation could significantly impact ongoing copyright lawsuits filed by major record labels in 2024, which allege Suno violated copyright law by using unlicensed music for training. The leaked code may serve as evidence in the litigation, where labels are seeking up to $150,000 per song for 662 allegedly copied tracks. Despite the breach’s severity, Suno has not publicly disclosed the incident or notified affected users. A spokesperson confirmed the November 2025 security incident but did not explain the delay in communication. Such prolonged silence may draw regulatory scrutiny, as breach notification laws in the EU, UK, and U.S. states typically require disclosure within days. The attack reportedly stemmed from stolen employee credentials rather than a direct system compromise. While Suno has stated it does not store full credit card numbers, the exposed partial payment details combined with personal information could facilitate social engineering attacks, such as fraudulent calls impersonating banks. The breach adds to Suno’s legal and reputational challenges, as the company continues to defend its fair use argument in court. Competitors, meanwhile, have taken a different approach, licensing music data and offering enterprise indemnification to avoid similar legal risks.

CNIL Fines Israeli Marketing Firm Optimove €1M for GDPR Violations in Massive Deezer Data Breach France’s data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), imposed a €1 million fine on Israeli marketing technology company Optimove (operating as Mobius Solutions Ltd.) on December 11, 2025, for systematic failures in GDPR compliance that led to a data breach affecting 46.9 million Deezer users worldwide, including 9.8 million in France. ### Key Violations and Findings The enforcement action targeted three GDPR violations: 1. Article 28(3)(g) – Failure to delete or return personal data after the contract with Deezer ended (December 1, 2020). Optimove retained non-anonymized user data in a non-production environment until October 1, 2023, nearly a year after Deezer reported the breach. 2. Article 29 – Processing personal data without controller instructions. Optimove copied data from 9.8 million French Deezer users to an unauthorized environment for internal use, despite contractual prohibitions. 3. Article 30 – Lack of a formal register of processing activities, a requirement for processors handling high-risk data, even for companies with fewer than 250 employees. The breach exposed sensitive user data, including identifiers, contact details, listening habits, payment information, and behavioral profiles, which later surfaced on the darknet, increasing risks of phishing and identity theft. ### How the Breach Unfolded - April 2019: Optimove employees copied non-anonymized Deezer user data from a production environment to an unauthorized non-production system. - December 1, 2020: The contract with Deezer ended, but Optimove failed to delete the data as required. - October 31–November 5, 2022: The breach occurred, exposing 46.9 million users globally. - November 10, 2022: Deezer notified CNIL, identifying Optimove as the likely source. - January 31, 2023: Deezer confirmed the breach originated from Optimove’s systems. - October 1, 2023: Optimove finally deleted the unauthorized data copy—nearly a year after the breach was reported. ### Legal and Regulatory Impact The case marks a significant enforcement action against a non-EU data processor, reinforcing that GDPR applies to companies monitoring behavior of EU individuals (Article 3(2)(b)), even if based outside the bloc. The CNIL rejected Optimove’s arguments that: - Employee actions without management knowledge excused the violations. - International comity (Israel’s adequacy status) should limit CNIL’s jurisdiction. - Behavioral profiling did not fall under GDPR’s territorial scope. The decision aligns with broader EU regulatory trends, where data processors face direct liability for compliance failures. Recent cases, such as McDonald’s Poland’s €3.89M fine (July 2025) and Germany’s standardized fine procedures (June 2025), underscore heightened scrutiny on processor accountability. ### Penalty Calculation and Next Steps The €1 million fine—below the 2% of global revenue cap—reflects CNIL’s consideration of Optimove’s financial situation (reported revenues of $30–40M in 2023–2024) and cooperation level, though the company initially contested responsibility. The decision will be publicly published for two years before anonymization. Optimove has four months to appeal to France’s Council of State but has not indicated whether it will challenge the ruling. The case serves as a precedent for marketing technology providers, emphasizing that processors must implement strict controls over data handling, deletion, and employee activities to avoid GDPR violations.

The "Mother of All Breaches": 26 Billion Records Exposed in Unprecedented Data Leak Security researchers have uncovered what may be the largest compilation of stolen credentials in history a 12-terabyte database dubbed the "Mother of All Breaches" (MOAB), containing 26 billion records from thousands of prior data leaks. Discovered by researcher Bob Dyachenko of SecurityDiscovery.com in collaboration with Cybernews, the dataset was found on an open, publicly accessible server, though its owner remains unknown. Unlike a single hack, the MOAB is a "compilation of breaches" (COB), aggregating credentials from major platforms, including: - 1.5 billion records from Tencent - 504 million from Weibo - 360 million from MySpace - 281 million from Twitter (X) - Millions more from LinkedIn, Adobe, Canva, Deezer, AdultFriendFinder, and others The dataset also includes records from government organizations in the U.S., Brazil, Germany, the Philippines, and Turkey, amplifying risks for both individuals and enterprises. ### Why This Breach Is a Game-Changer The MOAB’s danger lies in its consolidation and accessibility. Instead of scattered leaks, attackers now have a single, searchable repository for credential stuffing, phishing, and targeted attacks. While many passwords are outdated, the sheer volume ensures some will still work especially given widespread password reuse. Worse, experts warn the dataset may include fresh data from infostealer malware, which harvests current credentials, browser cookies, and autofill details. This hybrid threat combining historical breaches with live infections creates a highly effective tool for cybercriminals, from low-level fraudsters to initial access brokers (IABs) selling corporate network access to ransomware gangs. ### The Fallout: A New Era of Cyber Risk The MOAB’s impact extends beyond individuals. Corporate and government networks are at heightened risk due to employees reusing passwords across personal and work accounts. A single compromised credential could provide attackers with a foothold for devastating intrusions. Security experts emphasize that password-only authentication is now obsolete against such a vast dataset. The breach underscores the urgent need for multi-factor authentication (MFA), particularly phishing-resistant methods like FIDO2 security keys. Continuous monitoring of credentials against breach databases is also critical. With the data now in the wild, the MOAB will fuel cyberattacks for years, marking a sobering shift in the threat landscape. The leak serves as a stark reminder: once exposed, data never truly disappears it only becomes more dangerous.

A 60GB CSV file containing personal information, including that of the 228 million Deezer subscribers, was shared on a forum by a hacker. Deezer claims that hackers broke into one of their third-party partners and grabbed a snapshot of customer data. They advised customers to implement two-factor authentication and update their Deezer platform passwords.

The music streaming service Deezer suffered a data breach that impacted over 240M customers. The breach dated back to a mid-2019 backup exposed by a 3rd party partner which was subsequently sold and then broadly redistributed on a popular hacking forum. It impacted data including 229M unique email addresses, IP addresses, names, usernames, genders, DoBs and the geographic location of the customer.