Massive Data Breach at AI Music Generator Suno Exposed Personal Info of 55.3 Million Users

A cyberattack at AI music generator Suno last year allowed a hacker to steal the personal information of more than 55.3 million people, according to the data breach notification service Have I Been Pwned. The breach, which was only recently revealed, offers the first glimpse into the scale of the data theft.

Stolen Data Included Names, Addresses, Email Addresses, Phone Numbers, and Payment Card Info

Per Have I Been Pwned, the stolen data included customers' names, physical addresses, email addresses, phone numbers, purchases, and partial payment card numbers taken from the company's Stripe account, including card expiry dates. The breach happened in November 2025, but was only recently revealed thanks to reporting by independent news outlet 404 Media.

Suno's AI Music Generation Methods Under Fire

The data theft also included Suno's source code, which revealed how the company allegedly scraped millions of songs and lyrics from popular streaming sites, including Deezer, Genius, and YouTube, to train its AI models. Several major record labels are currently suing Suno, claiming that its mass-scraping efforts violate copyright law.

Company's Response to the Breach Raises Concerns

Suno has not yet publicly disclosed the cyberattack, or notified individuals that their information was taken. Suno co-founder Mikey Shulman did not respond to TechCrunch's request for comment about the incident. After publication, Suno spokesperson Rachel Racusen did not dispute the number of users affected, and confirmed that the company experienced a security incident in November 2025.

Estimated Reading Time: 4 minutes