In what is shaping up to be one of the most significant data breaches of the year, AI music generator Suno has confirmed that a cyberattack in November 2025 resulted in the theft of personal information belonging to over 55.3 million users. The revelation comes from the data breach notification service Have I Been Pwned (HIBP), which obtained a copy of the compromised dataset and provided the first comprehensive glimpse into the scale of the incident. According to HIBP, the stolen data includes customers' names, physical addresses, email addresses, phone numbers, purchase histories, and partial payment card numbers, including card expiration dates, taken from the company's Stripe account.
The breach also exposed Suno's source code, which has caused additional concerns beyond the immediate privacy implications. Analysis of the stolen code suggests that Suno systematically scraped millions of songs, lyrics, and metadata from popular streaming platforms such as Deezer, Genius, and YouTube to train its generative AI models. This revelation has added fuel to an already raging legal battle: several major record labels are currently suing Suno for copyright infringement, alleging that its mass-scraping efforts violate federal copyright law and deprive artists of fair compensation.
Background on Suno and Its Rapid Growth
Suno is a generative AI platform that allows users to create realistic music from text prompts, including instrumental tracks, vocals, and full songs. Founded in 2024 by a team of AI researchers and music enthusiasts, the company quickly gained traction among musicians, content creators, and hobbyists. By mid-2025, Suno boasted tens of millions of users and had attracted significant venture capital investment, with valuations reportedly exceeding $1 billion. The service operates on a freemium model, offering limited free usage and paid subscriptions for advanced features, which explains why the breached dataset includes partial payment card information.
Despite its popularity, Suno has faced criticism from artists and industry groups who argue that AI music generators trained on copyrighted material without permission constitute a form of digital copyright piracy. The breach has now revealed the extent of Suno's scraping operations, which the company had previously kept confidential. Legal experts note that the unauthorized access to source code could provide plaintiffs in the copyright lawsuit with substantial evidence of intentional infringement, potentially influencing the case's outcome.
Details of the Breach and Missing Notification
The cyberattack occurred in November 2025, but it remained unknown to the public until independent news outlet 404 Media published an investigative report in July 2026. Have I Been Pwned received a copy of the breached dataset and began notifying affected users that their information had been compromised. However, Suno itself has not publicly disclosed the incident on its website or through direct communication to users. When contacted by TechCrunch, Suno spokesperson Rachel Racusen did not dispute the number of affected users and confirmed that the company experienced a security incident in November 2025, but she did not explain why the company had not yet publicly acknowledged the breach or sent notifications to affected individuals.
This delay in notification has drawn sharp criticism from cybersecurity advocates and regulatory experts. Under data protection laws such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), companies are generally required to notify affected individuals and regulatory authorities within a reasonable timeframe—often 72 hours—of discovering a breach that poses a risk to users' rights and freedoms. The failure to do so can result in significant fines and legal liability. In this case, the breach occurred over eight months ago, and users have been left in the dark about the exposure of their financial and personal information.
Implications for Users and the AI Industry
The breach poses serious risks to affected users. Partial payment card numbers, combined with names, addresses, and phone numbers, can be used by cybercriminals to conduct targeted phishing attacks, identity theft, and financial fraud. Even though the full card numbers were not stolen (only the last four digits and expiration dates are typically stored by Stripe), such information can still be leveraged in social engineering scams. Security experts recommend that users monitor their bank and credit card statements closely for any unauthorized transactions and consider placing fraud alerts on their credit reports.
Beyond the immediate security concerns, the incident also raises questions about the broader accountability of AI companies. Suno is not the first AI startup to suffer a major data breach; earlier in 2026, Hugging Face was breached after an OpenAI pre-release model was compromised, and other AI firms have reported similar incidents. As these companies amass vast amounts of user data and proprietary training datasets, they become attractive targets for hackers seeking intellectual property and personal information. The Suno breach underscores the urgent need for robust cybersecurity practices in the AI sector, particularly among startups that may prioritize rapid growth over security infrastructure.
Legal and Regulatory Landscape
The breach also intersects with ongoing regulatory developments. In the United States, the Federal Trade Commission (FTC) has increasingly focused on data security failures, and several states have enacted or strengthened data breach notification laws. Internationally, the GDPR has been actively enforced against companies that fail to protect personal data. If Suno is found to have violated notification requirements, it could face penalties from multiple jurisdictions. Additionally, the copyright lawsuit against Suno may be amplified by the evidence of systematic scraping revealed in the source code theft.
Have I Been Pwned founder Troy Hunt commented on the incident, noting that the dataset was comprehensive and contained a large number of unique email addresses. He urged Suno to take responsibility and communicate transparently with affected users. As of this writing, Suno has not provided a timeline for when notifications might be sent or what steps they are taking to prevent future breaches.
The Suno breach is a stark reminder that even innovative AI startups are not immune to cyberattacks. As the industry continues to grow, both regulators and consumers will demand higher standards of data protection and incident response. For now, the 55 million affected users must wait for official word from Suno while safeguarding their own information.
Source: TechCrunch News