Suno AI Music Platform Suffers Massive Data Breach, Exposing 55.3 Million Records In November 2025, AI music generator Suno fell victim to a cyberattack that resulted in the theft of personal data belonging to over 55.3 million users, a breach only revealed this week by breach notification service Have I Been Pwned. The stolen dataset includes names, physical and email addresses, phone numbers, purchase records, and partial payment card details including card types, expiry dates, and the last four digits linked to Suno’s Stripe account. Beyond customer data, the hacker also exfiltrated Suno’s source code, which reportedly documents how the company scraped songs and lyrics from platforms like Deezer, Genius, and YouTube to train its AI models. This revelation could significantly impact ongoing copyright lawsuits filed by major record labels in 2024, which allege Suno violated copyright law by using unlicensed music for training. The leaked code may serve as evidence in the litigation, where labels are seeking up to $150,000 per song for 662 allegedly copied tracks. Despite the breach’s severity, Suno has not publicly disclosed the incident or notified affected users. A spokesperson confirmed the November 2025 security incident but did not explain the delay in communication. Such prolonged silence may draw regulatory scrutiny, as breach notification laws in the EU, UK, and U.S. states typically require disclosure within days. The attack reportedly stemmed from stolen employee credentials rather than a direct system compromise. While Suno has stated it does not store full credit card numbers, the exposed partial payment details combined with personal information could facilitate social engineering attacks, such as fraudulent calls impersonating banks. The breach adds to Suno’s legal and reputational challenges, as the company continues to defend its fair use argument in court. Competitors, meanwhile, have taken a different approach, licensing music data and offering enterprise indemnification to avoid similar legal risks.