Suno never disclosed a breach exposing 55 million users, and the stolen source code reveals how it scraped copyrighted music

Suno Lost 55 Million Users' Data and Its Own Source Code in a Breach It Never Disclosed

In November 2025, someone hacked Suno, the AI music generator that turns text prompts into full songs. They walked away with the personal data of 55.3 million people: email addresses, phone numbers, names, home addresses, records of what they bought, and partial credit card details traced to Suno's Stripe account 1.

Suno never said a word.

The breach surfaced only because the data breach notification service Have I Been Pwned obtained a copy of the stolen dataset and the independent news outlet 404 Media reported on it 2. As of publication, Suno has not publicly acknowledged the incident or contacted affected individuals. Co-founder Mikey Shulman did not respond when TechCrunch reached out for comment 2.

But the user data is only part of what was stolen. The hacker also exfiltrated Suno's source code, which reveals the company's alleged practice of scraping millions of songs and lyrics off Deezer, Genius, and YouTube to feed its AI training data 2.

That matters right now. Several major record labels are suing Suno, arguing that its mass-scraping of copyrighted recordings violates copyright law 2. Source code documenting exactly how that scraping worked, which platforms were targeted, and at what scale is now in circulation outside Suno's control. Whether it surfaces in those lawsuits is unknown, but the possibility turns a consumer data breach into something with broader legal stakes.

The data's specifics are granular. The dataset held more than 55 million unique email addresses. Phone numbers appeared where customers had used them to register. A subset of records tied to Stripe transactions included customers' names, home addresses, how much they spent, and fragments of their credit card data, such as card type, expiry date, and the last four digits of the card number 1. Suno told the breach notification service that it "does not have access to customers' full credit card numbers in Stripe" 1.

For the 55.3 million people affected, most still have no idea. Have I Been Pwned loaded the breach into its searchable database on July 20, 2026 1, so users can check whether their email address appears in the stolen set. Absent that voluntary lookup, they would have no signal at all, because Suno has not sent notifications, posted a disclosure, or otherwise alerted anyone 2.

Step back, and three threads connect. Suno allegedly scraped music from major streaming platforms to build its product. It failed to secure user data, including payment information, well enough to prevent the theft of 55.3 million records. And when the theft happened, it stayed quiet for eight months rather than tell people their information had been taken.

Each thread alone is a serious story. Together, they describe a company that has operated without accountability at every layer: toward the artists whose work it allegedly used, toward the users whose trust it collected along with their payment details, and toward a legal system now asking questions about both.

Suno has not publicly addressed the breach, the source code exposure, or anything related. Eight months in, the only constant is the silence.