Suno AI Music Platform Suffers Massive Data Breach, Exposing 55 Million Users Suno, a Cambridge, Massachusetts-based AI music generation platform, has confirmed a data breach affecting over 55.3 million users, according to breach tracking site Have I Been Pwned. The incident exposed sensitive user information, including email addresses, phone numbers, and tens of thousands of Stripe payment records containing names, physical addresses, purchase amounts, and partial credit card details (card type, expiry dates, and last four digits). While Suno does not store full credit card numbers, the leaked data could enable targeted phishing attacks, with fraudsters using real transaction details to trick users into disclosing further financial information. The breach also revealed internal source code from 2023–2024, confirming that Suno trained its AI models using copyrighted music scraped from platforms like YouTube, Deezer, and Genius a practice the company defends as "fair use." This revelation amplifies ongoing legal disputes, including lawsuits from Sony Music, UMG Recordings, and Warner Records, which accuse AI music platforms of mass copyright infringement and undermining human artists. Notably, Warner has since settled with Suno and entered a partnership, while other cases remain unresolved. Security experts have criticized Suno’s response or lack thereof. The company has not publicly acknowledged the breach, identified the attack vector, or attributed responsibility to a threat actor. Seemant Sehgal, CEO of BreachLock, warned that the scale of the leak suggests poor internal visibility and incident readiness, raising concerns about regulatory scrutiny and customer trust. Meanwhile, Steven Swift of Suzu Labs noted that while AI-assisted development may introduce security risks, most breaches stem from failure to follow basic security practices, emphasizing the need for regular penetration testing and robust controls. The incident underscores broader tensions in the AI music industry, where platforms like Suno, Udio, and Stability AI face accusations of enabling deepfake music replicating artists’ voices and styles to create near-identical imitations of hits, including songs like Mariah Carey’s "All I Want for Christmas Is You." Critics argue these tools risk devaluing human creativity and facilitating fraud, while proponents claim they democratize music production. For now, the fallout from Suno’s breach remains unresolved, with affected users at heightened risk of phishing and identity theft.