Suno AI Music Platform Hit by Massive Data Breach Affecting 55.3 Million Users
A cyberattack on AI music generator Suno in November 2025 exposed the personal data of 55.3 million users, marking one of the largest breaches of the year. The incident, first revealed by 404 Media and confirmed by data breach notification service Have I Been Pwned, involved the theft of sensitive customer information, including names, physical addresses, email addresses, phone numbers, purchase histories, and partial payment card details along with card expiry dates extracted from Suno’s Stripe account.
The breach also compromised Suno’s source code, which reportedly contained evidence of the company’s alleged mass-scraping of songs and lyrics from platforms like Deezer, Genius, and YouTube to train its AI models. This revelation aligns with ongoing copyright lawsuits filed by major record labels, accusing Suno of unlawful data collection.
Despite the scale of the breach, Suno has not publicly acknowledged the incident or notified affected users. Co-founder Mikey Shulman did not respond to requests for comment from TechCrunch. The delayed disclosure raises concerns about transparency and compliance with data protection regulations.
Suno TPRM report: https://www.rankiteo.com/company/sunomusic
Stripe TPRM report: https://www.rankiteo.com/company/stripe
"id": "strsun1784651361",
"linkid": "stripe, sunomusic",
"type": "Breach",
"date": "7/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '55.3 million',
'industry': 'AI Music Generation',
'name': 'Suno',
'type': 'Company'}],
'data_breach': {'file_types_exposed': ['Source code', 'User data'],
'number_of_records_exposed': '55.3 million',
'personally_identifiable_information': ['Names',
'Physical addresses',
'Email addresses',
'Phone numbers',
'Purchase histories'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Identifiable '
'Information (PII)',
'Payment Information',
'Source Code']},
'date_detected': '2025-11',
'description': 'A cyberattack on AI music generator Suno in November 2025 '
'exposed the personal data of 55.3 million users, including '
'names, physical addresses, email addresses, phone numbers, '
'purchase histories, and partial payment card details. The '
'breach also compromised Suno’s source code, revealing alleged '
'mass-scraping of songs and lyrics from platforms like Deezer, '
'Genius, and YouTube to train its AI models.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'delayed disclosure and copyright '
'lawsuits',
'data_compromised': 'Personal data of 55.3 million users, '
'including names, physical addresses, email '
'addresses, phone numbers, purchase histories, '
'partial payment card details, and source code',
'identity_theft_risk': 'High',
'legal_liabilities': 'Ongoing copyright lawsuits from major record '
'labels',
'payment_information_risk': 'High (partial payment card details '
'exposed)'},
'references': [{'source': '404 Media'},
{'source': 'Have I Been Pwned'},
{'source': 'TechCrunch'}],
'regulatory_compliance': {'legal_actions': 'Ongoing copyright lawsuits from '
'major record labels'},
'response': {'communication_strategy': 'No public acknowledgment or user '
'notifications'},
'title': 'Suno AI Music Platform Data Breach',
'type': 'Data Breach'}