A massive data breach at AI music generator Suno has exposed personal information linked to more than 55 million user accounts, calling into question the company’s characterization of the event as a “limited security incident” that was “quickly contained.” The incident, which occurred in November 2025 and was later logged as affecting approximately 55.3 million accounts and 55,282,226 unique email addresses, surfaced publicly only in mid-July 2026 following external reporting and its addition to breach notification services.
The compromised dataset paints a far broader picture than Suno’s early public statements implied, encompassing names, email addresses, phone numbers, physical addresses, purchase records, and partial payment card data drawn from Stripe transactions. Breach listings indicate that more than 55 million unique email addresses are present in the corpus, alongside customer lists that include contact details for hundreds of thousands of users and tens of thousands of purchase records with card type, expiry date, and last four digits of payment cards.
The exposed dataset spans names, contacts, addresses, purchases and partial Stripe card metadata
While full primary account numbers and complete card data do not appear in the exposed files, the combination of personal identifiers, contact information, and transaction history still represents a substantial trove of information that could be misused for phishing, identity matching, and other forms of social engineering.
The breach also laid bare technical details of Suno’s AI music operations. The attacker, reportedly using a tool referred to as the SHAI-HULUD WORM, gained access through a supply-chain compromise involving employee credentials and reached internal source code repositories and customer data. Files obtained in the intrusion documented large-scale scraping of songs, audio, and lyrics from platforms such as YouTube Music, Deezer, Genius, and various podcast feeds, revealing how Suno assembled extensive training datasets from third-party services. The exposure of these scraping operations comes as major record labels pursue ongoing lawsuits against Suno alleging copyright violations tied to its mass-scraping of songs and lyrics.
Suno’s internal investigation has emphasized that the exposed code was largely outdated and no longer reflected its current production systems, but the materials nonetheless show a sophisticated ingestion pipeline built to process massive volumes of media content for generative models.
Timeline and disclosure details have generated additional scrutiny. Although Suno learned of the intrusion in November 2025, the incident did not become widely known until mid-July 2026, when external reporting and breach notification services highlighted the scale of the customer data exposure.
Have I Been Pwned and Mozilla Monitor both logged the breach on July 20, 2026, confirming the presence of tens of millions of email addresses and associated records in the leaked dataset. Suno, however, reportedly concluded that individual user notification was not required under applicable privacy laws, maintaining that the compromise involved limited and primarily non-sensitive information and reiterating that the company does not have access to full credit card numbers within its Stripe integration.
The Suno breach underscores growing risks at AI platforms, where training pipelines and payment systems intersect, magnifying consequences when internal security controls fail for their users.
