Suno AI breach hits 55.3 million users, exposes scraping code
AI music generator Suno has silently exposed the personal and financial data of 55.3 million users in a November cyberattack, while the stolen source code threatens to escalate its ongoing copyright battles with major record labels.
A massive cyberattack on AI music generator Suno has compromised the personal and financial data of more than 55.3 million users. The breach occurred in November 2025, but the company has not publicly disclosed the incident or notified the affected individuals. Spokesperson Rachel Racusen confirmed the November security incident and did not dispute the scale of the data theft uncovered by the breach notification service Have I Been Pwned.
The stolen dataset contains highly sensitive information that extends far beyond basic contact details. According to Have I Been Pwned, hackers accessed customers' names, physical addresses, email addresses, and phone numbers. Crucially, the breach also included user purchase histories and partial payment card numbers, complete with expiry dates, extracted directly from Suno’s Stripe payment account.
The company's prolonged silence poses a severe regulatory risk, particularly within the European Union. Under the GDPR, organisations are strictly required to notify supervisory authorities and affected individuals without undue delay when a breach threatens their rights and freedoms. The exposure of physical addresses and partial financial data clearly meets this threshold, yet Suno has offered no public explanation for its delay.
Beyond user data, the attackers also stole Suno’s underlying source code. This code leak is highly significant because it allegedly reveals exactly how the startup trained its AI models. The stolen files indicate Suno systematically scraped millions of songs and lyrics from streaming platforms like Deezer, Genius, and YouTube.
This technical exposure directly threatens Suno's market position by strengthening ongoing litigation. Several major record labels are currently suing the company, alleging that its mass-scraping practices constitute widespread copyright violation. The leaked source code could serve as incontrovertible evidence for the plaintiffs, severely weakening Suno's legal defence and likely deterring venture capital from backing similar AI startups facing intellectual property disputes.
The incident was brought to light by independent outlet 404 Media, not by Suno's own security teams. Co-founder Mikey Shulman has not commented on the breach. For a company already fighting existential legal battles over its foundational technology, a massive, unreported data breach represents a compounding crisis of regulatory and legal liability.
