Suno Breach Exposes 55 Million User Accounts
Suno suffered a November 2025 breach that exposed 55.3 million user accounts, according to Have I Been Pwned. The dataset included email addresses, some phone numbers and tens of thousands of Stripe purchase records with names, addresses and partial card details; a July 17 Suno statement saying no sensitive personal information was compromised remains unreconciled with HIBP's later record, while leaked code reported by 404 Media described historical AI-training datasets.
AI music generator Suno suffered a data breach in November 2025 that exposed 55.3 million user accounts, according to breach-notification service Have I Been Pwned (HIBP). The dataset contained email addresses, phone numbers for users who registered with them, and tens of thousands of Stripe purchase records containing names, physical addresses, purchase amounts and partial payment-card information.
HIBP added the breach to its service on July 20, 2026. It identifies the exposed payment fields as card type, expiry date and last four digits; HIBP also notes that Suno said it does not have access to customers' full credit-card numbers in Stripe.
A Suno statement reported by PC Gamer on July 17 described the November incident as limited and quickly contained. The spokesperson said the investigation primarily involved outdated source code no longer used by the company and that no sensitive personal information was compromised. That statement predates HIBP's July 20 record listing names, physical addresses, phone numbers, purchases and partial card data, and the retrieved evidence does not reconcile the two accounts. The Register reported on July 21 that Suno did not immediately respond to its request for comment.
The reported scale is substantially larger than the initial account-access estimate. When 404 Media first reported the hack on July 15, the outlet wrote that the person claiming responsibility had accessed information on hundreds of thousands of Suno customers. HIBP's subsequent ingestion of the dataset placed the count above 55 million.
Leaked code exposes training-data details
The breach also produced source code that the hacker shared with 404 Media. The outlet reported that code apparently dating from 2023 and 2024 contained scraping instructions for music, lyrics, stock-audio libraries, public-domain score collections and podcast RSS feeds.
According to 404 Media's review, the source code named YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, the International Music Score Library Project and RSS podcast feeds among the sources. One file recorded 2,013,545 ingested YouTube Music clips. Other code comments listed dataset-duration figures, including 113,879 hours for youtube_music, 17,615 hours for genius_hq, 62,117 hours for pond5_music and 152,162 hours for ytm_tagged.
Those records offer a more granular picture of historical data-ingestion workflows than previous public descriptions. 404 Media noted that Suno had previously acknowledged training on "essentially all music files of reasonable quality that are accessible on the open internet," including tens of millions of recordings, while arguing in litigation that this training qualifies as fair use. The leaked code is evidence about collection workflows; it does not by itself resolve the pending copyright claims.
Copyright dispute and security implications
The Register reported that record labels represented by the Recording Industry Association of America sued Suno in 2024 over alleged unlicensed mass scraping. It also reported that Warner settled and entered a commercial partnership with Suno, while Sony and Universal Music Group continued their claims.
For ML teams, the incident illustrates two distinct risk surfaces that can coexist in generative-AI systems: consumer-data protection and training-data provenance. Source repositories, crawler configurations, manifests and dataset metadata can reveal collection scope even when model weights are not exposed.
Affected users should treat the exposure as an account-security event. HIBP recommends changing reused passwords and enabling two-factor authentication where available. Because the exposed data reportedly includes contact and purchase details, users should also be alert to targeted phishing that incorporates those fields.
Key Points
- 1HIBP lists 55.3 million exposed Suno accounts and says the dataset included contact details, purchase records and partial payment-card data.
- 2Suno's July 17 statement that no sensitive personal information was compromised predates and remains unreconciled with HIBP's July 20 breach record.
- 3Leaked code reported by 404 Media identified specific music, lyric and audio sources used in historical training-data collection workflows.
Scoring Rationale
The HIBP-reported exposure of 55.3 million accounts makes this a large security incident with direct relevance to AI product operators. The accompanying source-code reporting also provides rare, concrete detail on training-data ingestion practices, while the conflict between Suno's earlier statement and HIBP's later record remains unresolved.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
