AI music app Suno breach hits 55M users, Have I Been Pwned confirms
▼ Summary
– A cyberattack on AI music generator Suno in November 2025 stole personal data of over 55.3 million people, including names, addresses, emails, phone numbers, purchases, and partial payment card details.
– The breach was revealed by Have I Been Pwned, which obtained the stolen dataset, and reported by 404 Media.
– Stolen source code showed Suno allegedly scraped millions of songs from streaming sites like Deezer, Genius, and YouTube to train its AI models.
– Major record labels are suing Suno, claiming its mass-scraping violates copyright law.
– Suno has not publicly disclosed the attack or notified affected individuals, and its co-founder did not comment.
A major cyberattack targeting the AI music platform Suno has compromised the personal data of more than 55.3 million users, according to the data breach notification service Have I Been Pwned. This confirmation marks the first authoritative look at the full scope of the incident, which occurred in November 2025 but only came to light after reporting by independent outlet 404 Media.
The stolen dataset includes customers’ names, physical addresses, email addresses, phone numbers, purchase histories, and partial payment card information from the company’s Stripe account, including card expiration dates. Have I Been Pwned, which obtained a copy of the breached data, verified these findings.
Beyond user data, the breach also exposed Suno’s source code, which reportedly reveals how the company scraped millions of songs and lyrics from streaming platforms like Deezer, Genius, and YouTube to train its AI models. This discovery adds fuel to an ongoing legal battle: several major record labels are currently suing Suno, alleging that its mass-scraping practices violate copyright law.
To date, Suno has not publicly disclosed the cyberattack or notified affected individuals. Co-founder Mikey Shulman did not respond to TechCrunch’s request for comment about the incident. The silence raises concerns about transparency and user protection in the wake of one of the largest music AI data breaches on record.
(Source: TechCrunch)
