AI music generator Suno has confirmed a data breach in November 2025 that, according to breach-notification service Have I Been Pwned, exposed the personal information of 55.3 million users.
Have I Been Pwned said it had obtained a copy of the stolen dataset and added the records to its database on July 20.
The breach was first reported by independent outlet 404 Media on July 15, in the same investigation that exposed Suno‘s source code – and, with it, how the company trained its AI models.
1. More than 55 million email addresses were exposed – and Stripe records went further
The dataset Have I Been Pwned obtained contained more than 55 million unique email addresses – 55,282,226 of them – plus phone numbers where users had provided them at sign-up, the service said.
A smaller portion – tens of thousands of Stripe purchase records – also held customers’ names, physical addresses, purchase amounts, and partial card details, including the card type, expiry date, and last four digits, according to Have I Been Pwned.
Roughly 24% of the email addresses in the dataset had already appeared in previous breaches, the service said.
When 404 Media broke the story on July 15, it reported that the hacker had accessed information on hundreds of thousands of Suno customers.
Have I Been Pwned‘s listing five days later put the figure above 55 million.
In its statement to 404 Media, a Suno spokesperson said: “Importantly, Suno does not have access to customers’ full credit card numbers in Stripe.”
2. Suno sat on the breach for eight months – and never told users
Suno determined in November 2025 that it had been “the subject of a limited security incident that was quickly contained,” a company spokesperson told 404 Media.
The spokesperson said Suno had “immediately conducted an investigation and verified that the incident primarily involved outdated source code that is no longer in use at Suno” and that “no sensitive personal information was compromised.”
Suno concluded that individual breach notifications “were not warranted under applicable privacy laws,” the spokesperson said.
The company did not disclose the breach publicly at the time, according to 404 Media and TechCrunch.
Some Suno customers whose records were exposed told 404 Media that they had not been notified of the breach.
Suno had not publicly acknowledged the breach on its website at the time and did not provide TechCrunch with any notice it may have sent to users, according to the publication.
After TechCrunch published its report on July 21, Suno spokesperson Rachel Racusen did not dispute the number of users affected and confirmed that the company had experienced a security incident in November 2025, the outlet said.
That leaves roughly eight months between the breach and its public disclosure.
3. The same hack exposed the extent of Suno’s scraping
The breach came to light because the hacker also obtained Suno‘s source code, according to 404 Media, which reviewed the data.
The leaked code showed the company had scraped songs and lyrics from platforms including YouTube Music, Deezer, and Genius, the report said.
Comments in one file said the system would pull from “genius_hq, youtube_music, freesound, jamendo, imp, deezer, ytm_tagged,” and that “non-music will be filtered out,” while a file named “youtube_music” logged 2,013,545 music clips, 404 Media said.
The datasets included 113,879 hours under youtube_music, a further 152,162 hours under ytm_tagged, 62,117 hours from stock library Pond5, 19,514 hours from the International Music Score Library Project, 17,615 hours from Genius, and 12,287 hours from Deezer – at least decades of audio, the outlet reported.
The hacker, who uses the name ellie.191, told 404 Media they gained access by infecting a Suno employee with Shai-Hulud, a supply-chain worm that steals GitHub and cloud-service credentials.
MBW published a fuller breakdown of the hacked code when the story emerged, including the platforms Suno drew on and the volume of material it logged.
4. Suno is now facing a class action over the silence
Suno was hit with a proposed class action on July 24 in the US District Court for the District of Massachusetts, where the company is headquartered.
The named plaintiff, Alec Pilavian, a Florida resident and Suno customer, is seeking to represent everyone in the US whose data was compromised.
The complaint alleges that Suno knew about the incident in November 2025 but that users learned of it only when it was reported publicly on July 20.
It accuses the company of relying on “cheap, ineffective security measures,” and seeks damages plus a court order requiring at least ten years of credit monitoring for class members.
Responding to the suit, a Suno spokesperson told MBW the incident “primarily involved outdated source code and a limited amount of information associated with certain users.”
The spokesperson said Suno does not store customers’ full payment card information and does not collect bank account details, and that the company had hired a third-party cybersecurity expert to audit its initial findings.
5. It lands in the middle of Suno’s copyright fight
Suno is defending itself against Universal Music Group and Sony Music Entertainment in a copyright infringement lawsuit coordinated by the RIAA, and argues that training on copyrighted works is protected as fair use.
In a court filing, Suno has said its training data “includes essentially all music files of reasonable quality that are accessible on the open internet.”
UMG and Sony Music Entertainment are seeking to expand the case to more than 61,000 recordings, a move that could raise the maximum possible statutory damages to more than USD $9 billion, up from around $84 million under the original 560-work complaint, as MBW has reported.
Suno also lost a copyright infringement case brought by German collecting society GEMA on July 31, when the Munich Regional Court ruled it had infringed by training on the society’s repertoire – the first ruling of its kind in Europe.
Warner Music Group settled with Suno in November 2025 and entered a licensing partnership that included Suno‘s acquisition of the concert-discovery platform Songkick.
Reservoir (Nasdaq: RSVR) is a publicly traded, global independent music company with operations across music publishing, recorded music, and artist management. Music Business Worldwide
