Suno AI Music Platform Suffers Massive Data Breach, Exposing 55.3 Million Records In November 2025, AI music generator Suno fell victim to a cyberattack that resulted in the theft of personal data belonging to over 55.3 million users, a breach only revealed this week by breach notification service Have I Been Pwned. The stolen dataset includes names, physical and email addresses, phone numbers, purchase records, and partial payment card details including card types, expiry dates, and the last four digits linked to Suno’s Stripe account. Beyond customer data, the hacker also exfiltrated Suno’s source code, which reportedly documents how the company scraped songs and lyrics from platforms like Deezer, Genius, and YouTube to train its AI models. This revelation could significantly impact ongoing copyright lawsuits filed by major record labels in 2024, which allege Suno violated copyright law by using unlicensed music for training. The leaked code may serve as evidence in the litigation, where labels are seeking up to $150,000 per song for 662 allegedly copied tracks. Despite the breach’s severity, Suno has not publicly disclosed the incident or notified affected users. A spokesperson confirmed the November 2025 security incident but did not explain the delay in communication. Such prolonged silence may draw regulatory scrutiny, as breach notification laws in the EU, UK, and U.S. states typically require disclosure within days. The attack reportedly stemmed from stolen employee credentials rather than a direct system compromise. While Suno has stated it does not store full credit card numbers, the exposed partial payment details combined with personal information could facilitate social engineering attacks, such as fraudulent calls impersonating banks. The breach adds to Suno’s legal and reputational challenges, as the company continues to defend its fair use argument in court. Competitors, meanwhile, have taken a different approach, licensing music data and offering enterprise indemnification to avoid similar legal risks.

Suno AI Music Platform Hit by Massive Data Breach Affecting 55.3 Million Users A cyberattack on AI music generator Suno in November 2025 exposed the personal data of 55.3 million users, marking one of the largest breaches of the year. The incident, first revealed by 404 Media and confirmed by data breach notification service Have I Been Pwned, involved the theft of sensitive customer information, including names, physical addresses, email addresses, phone numbers, purchase histories, and partial payment card details along with card expiry dates extracted from Suno’s Stripe account. The breach also compromised Suno’s source code, which reportedly contained evidence of the company’s alleged mass-scraping of songs and lyrics from platforms like Deezer, Genius, and YouTube to train its AI models. This revelation aligns with ongoing copyright lawsuits filed by major record labels, accusing Suno of unlawful data collection. Despite the scale of the breach, Suno has not publicly acknowledged the incident or notified affected users. Co-founder Mikey Shulman did not respond to requests for comment from TechCrunch. The delayed disclosure raises concerns about transparency and compliance with data protection regulations.

Suno’s 2025 Data Breach Exposed 55M Email Addresses, Payment Details, and AI Training Secrets In November 2025, AI music startup Suno suffered a supply-chain attack that compromised extensive user data and internal systems. The breach, which remained undisclosed for eight months, was confirmed on July 20, 2026, when breach monitoring service Have I Been Pwned listed 55.3 million unique email addresses tied to Suno’s systems. The attack originated from malware on a developer’s laptop, introduced via third-party code. The threat actor used stolen credentials to move laterally within Suno’s environment, accessing Stripe payment records, source code repositories, and user data. Exposed information included names, physical addresses, phone numbers, purchase histories, and partial payment card numbers with expiry dates. Suno initially downplayed the incident, claiming only "outdated source code" was affected a statement contradicted by TechCrunch and Mozilla Monitor. Beyond user data, the breach revealed Suno’s AI training pipeline, providing rare evidence for ongoing RIAA lawsuits. Leaked documentation detailed a large-scale scraping operation, including: - 113,879 hours of YouTube Music content - 152,162 tagged YouTube tracks - 62,117 Pond5 files - 12,287 Deezer tracks - 17,615 Genius lyrics - 19,514 IMSLP files Suno reportedly used Bright Data, a commercial proxy service, to bypass anti-bot protections while harvesting content. The company has previously argued its training practices fall under fair use, but the leaked code provides concrete evidence for copyright disputes. Despite the severity of the breach, Suno has not notified affected users. Independent services like Have I Been Pwned and Mozilla Monitor remain the primary sources of disclosure for those impacted.

Suno AI Music Platform Suffers Massive Data Breach, Exposing 55 Million Users Suno, a Cambridge, Massachusetts-based AI music generation platform, has confirmed a data breach affecting over 55.3 million users, according to breach tracking site Have I Been Pwned. The incident exposed sensitive user information, including email addresses, phone numbers, and tens of thousands of Stripe payment records containing names, physical addresses, purchase amounts, and partial credit card details (card type, expiry dates, and last four digits). While Suno does not store full credit card numbers, the leaked data could enable targeted phishing attacks, with fraudsters using real transaction details to trick users into disclosing further financial information. The breach also revealed internal source code from 2023–2024, confirming that Suno trained its AI models using copyrighted music scraped from platforms like YouTube, Deezer, and Genius a practice the company defends as "fair use." This revelation amplifies ongoing legal disputes, including lawsuits from Sony Music, UMG Recordings, and Warner Records, which accuse AI music platforms of mass copyright infringement and undermining human artists. Notably, Warner has since settled with Suno and entered a partnership, while other cases remain unresolved. Security experts have criticized Suno’s response or lack thereof. The company has not publicly acknowledged the breach, identified the attack vector, or attributed responsibility to a threat actor. Seemant Sehgal, CEO of BreachLock, warned that the scale of the leak suggests poor internal visibility and incident readiness, raising concerns about regulatory scrutiny and customer trust. Meanwhile, Steven Swift of Suzu Labs noted that while AI-assisted development may introduce security risks, most breaches stem from failure to follow basic security practices, emphasizing the need for regular penetration testing and robust controls. The incident underscores broader tensions in the AI music industry, where platforms like Suno, Udio, and Stability AI face accusations of enabling deepfake music replicating artists’ voices and styles to create near-identical imitations of hits, including songs like Mariah Carey’s "All I Want for Christmas Is You." Critics argue these tools risk devaluing human creativity and facilitating fraud, while proponents claim they democratize music production. For now, the fallout from Suno’s breach remains unresolved, with affected users at heightened risk of phishing and identity theft.