The Suno Breach: Data of 55 Million Users at Risk

The breach-notification service Have I Been Pwned has revealed the scale of the cyberattack on the AI-powered music generator Suno. According to its figures, the intruder stole the personal information of more than 55.3 million people — the first estimate of how much was taken.

What the hacker got hold of

Have I Been Pwned obtained a copy of the stolen trove. It contained customers' names, physical and email addresses, phone numbers, purchase details, and partial payment-card numbers along with their expiration dates — data pulled from the company's account with the payment service Stripe.

The attack itself dates back to November 2025, yet it only came to light recently, thanks to a report by the independent outlet 404 Media.

The source code leaked too

Beyond the customer data, the intruder obtained Suno's source code. It reportedly showed how the company scraped millions of songs and lyrics from popular streaming platforms — Deezer, Genius and YouTube among those named — to train its models.

This thread overlaps with another of Suno's problems: several major record labels are already suing the service, accusing it of infringing copyright through its mass harvesting of material. The leaked code risks becoming an additional argument in those proceedings.

The company's silence

Notably, Suno still hasn't disclosed the hack publicly and hasn't notified those affected that their data was stolen. Company co-founder Mikey Shulman did not respond to TechCrunch's request for comment.

Source: TechCrunch