Suno Cyberattack Exposed Data of Over 55 Million Users
Quick Look
- A November 2025 cyberattack on AI music generator Suno exposed personal data of over 55.3 million people, including names, addresses, and partial payment info.
- The breach also stole Suno's source code, revealing alleged song scraping practices now subject to copyright lawsuits.
- Suno has not publicly disclosed the incident.
AI-generated summary
Why It Matters
A cyberattack in November 2025 on AI music generator Suno led to the theft of personal data from over 55.3 million people and the company's source code. The breach was recently revealed by 404 Media and confirmed by Have I Been Pwned.
A cyberattack at AI music generator Suno last year allowed a hacker to steal the personal information of more than 55.3 million people, according to the data breach notification service Have I Been Pwned, offering the first glimpse into the scale of the data theft.
Per Have I Been Pwned, which obtained a copy of the breached dataset, the stolen data included customers’ names, physical addresses and email addresses, phone numbers, purchases, and partial payment card numbers taken from the company’s Stripe account, including card expiry dates.
The breach happened in November 2025, but was only recently revealed thanks to reporting by independent news outlet 404 Media.
The data theft also included Suno’s source code, which revealed how the company allegedly scraped millions of songs and lyrics from popular streaming sites, including Deezer, Genius, and YouTube, to train its AI models. Several major record labels are currently suing Suno, claiming that its mass-scraping efforts violate copyright law.
Suno has not yet publicly disclosed the cyberattack, or notified individuals that their information was taken. Suno co-founder Mikey Shulman did not respond to TechCrunch’s request for comment about the incident.
After publication, Suno spokesperson Rachel Racusen did not dispute the number of users affected, and confirmed that the company experienced a security incident in November 2025. It’s not clear why the company has not yet publicly acknowledged the data breach on its website. The company did the company provide TechCrunch, when asked, with any communication the company may have sent to users informing them of a data breach.
What to Watch
AI outlook — possibilities, not facts
Suno will likely face further legal and regulatory scrutiny regarding the data breach and its disclosure practices.
Likely · Within months
The ongoing copyright lawsuit against Suno by major record labels will likely intensify, leveraging the revealed source code.
Likely · Within months
Open Questions
- Why has Suno not publicly disclosed the breach?
- Why were users not notified?
- What specific measures is Suno taking now?
