AI music generator Suno has confirmed a data breach in November 2025 that reportedly exposed the personal information of 55.3 million users.
The scale was revealed by breach-notification service Have I Been Pwned, which said it obtained a copy of the breached dataset and added the records to its database on Monday (July 20).
Suno spokesperson Rachel Racusen did not dispute the number of users affected and confirmed that the company had experienced a security incident in November 2025, TechCrunch reported on Tuesday (July 21).
The dataset held by Have I Been Pwned (HIBP) contained more than 55 million unique email addresses, plus phone numbers where users had provided them at sign-up.
A smaller portion of the data – tens of thousands of Stripe purchase records – also held customers’ names, physical addresses, purchase amounts, and partial card details, including the card type, expiry date, and last four digits.
When independent outlet 404 Media first reported the breach on July 15, the hacker was described as having accessed information on hundreds of thousands of Suno customers.
Responding when the breach emerged, a Suno spokesperson said the company had determined in November 2025 that it was “the subject of a limited security incident that was quickly contained.”
“We immediately conducted an investigation and verified that the incident primarily involved outdated source code that is no longer in use at Suno and that no sensitive personal information was compromised,” the spokesperson said.
“Importantly, Suno does not have access to customers’ full credit card numbers in Stripe,” they added.
The spokesperson said Suno had concluded that individual breach notifications “were not warranted under applicable privacy laws.”
Some customers whose records were exposed had earlier told 404 Media that they had not been notified of a breach.
The company has not publicly acknowledged the breach on its website and did not provide TechCrunch with any notice it may have sent to users, according to the report.
The breach came to light through the same hack that exposed how Suno trains its models.
Leaked source code showed the company had scraped songs and lyrics from platforms including YouTube Music, Deezer, and Genius.
The hacker, who uses the name ellie.191, told 404 Media they gained access by infecting a Suno employee with Shai-Hulud, a supply-chain worm that steals GitHub and cloud-service credentials.
Suno CEO Mikey Shulman said in February that more than 100 million people had used the service.
The company raised more than $400 million in June in a Series D round that valued it at $5.4 billion.
Suno is defending itself against Universal Music Group and Sony Music Entertainment in a copyright infringement lawsuit coordinated by the RIAA, and argues that training on copyrighted works is protected as fair use.
In a court filing, Suno has said its training data “includes essentially all music files of reasonable quality that are accessible on the open internet.”
UMG and Sony Music Entertainment are seeking to expand the case to more than 61,000 recordings, which could raise the maximum possible statutory damages to more than $9 billion.
Warner Music Group settled with Suno in November 2025 and entered a licensing partnership that included Suno‘s acquisition of Songkick.
UMG and Sony Music Entertainment remain in active litigation with the company.Music Business Worldwide
