More than 55.3 million users of AI music platform Suno had their personal information exposed in a cyberattack that took place last year, according to Have I Been Pwned (HIBP). This is from the same attack that was brought to light by 404 Media last week, which also revealed the platform’s controversial data gathering practice for training its AI.
For those unfamiliar, Suno is one of the most popular generative AI music platforms, allowing users to create complete songs with vocals and instrumentals using simple text prompts. The service has gained widespread attention over the past two years, but has also been at the centre of multiple copyright lawsuits over how its AI models were trained.
According to HIBP, which obtained a copy of the stolen database, the breach affected 55,364,811 accounts. The compromised information includes users’ names, physical addresses, email addresses, phone numbers, purchase records, and partial payment card details from the company’s Stripe payment system, including card expiry dates.
Hack Also Exposed Suno’s AI Training Data
Other than customer information, the leaked source code has also provided fresh insight into how Suno allegedly built the datasets used to train its AI music models. In its report, 404 Media said a hacker, using the alias “ellie.191”, gained access to Suno’s internal systems via a supply-chain attack that compromised an employee’s credentials, allowing them to access both customer data and the company’s source code.
The code references large-scale scraping of songs, lyrics, and audio from services including Deezer, Genius, YouTube Music, stock music libraries and podcast feeds. Some files reportedly indicate that more than two million YouTube Music clips had been collected, alongside hundreds of thousands of hours of audio from multiple online sources.
Due to this, Suno is already facing lawsuits from major record labels, including Sony Music and Universal Music Group, which accuse the company of using copyrighted recordings without permission to train its AI models. Suno has previously acknowledged in court filings that its models were trained using publicly available music and related metadata, while arguing that doing so falls under fair use.
Suno Has Not Notified Users
Despite the breach affecting tens of millions of users, Suno has yet to publicly disclose the incident on its website or notify affected customers. In a statement to TechCrunch, company spokesperson Rachel Racusen confirmed that the company experienced a security incident in November 2025 and did not dispute the reported number of affected users.
Suno claims that the incident was quickly contained, primarily involved outdated source code, and that it does not have access to customers’ full payment card numbers through Stripe. It also said it determined that notifying individual users was not required under applicable privacy laws.
What Should Users Do?
Although the exposed payment card information was limited to partial card numbers and expiry dates, affected users should still take precautionary measures. Changing your Suno account password is recommended, particularly if the same password has been reused on other online services. It is also advisable to remain vigilant for phishing emails, text messages, or phone calls that may attempt to exploit the leaked personal information.
Affected users should also keep an eye on their bank and credit card statements for any suspicious or unauthorised transactions. Additionally, checking whether your email address appears on Have I Been Pwned or other trusted breach notification services can help determine if your account was affected by this or other data breaches.
(Source: HIBP / TechCrunch / 404 Media)
