Suno data breach exposes personal information of more than 55 million people

The breach, which was recently reported by 404 Media, reportedly exposed names, physical addresses, email addresses, phone numbers and purchase histories. Partial payment card information from Suno's Stripe account was also among the compromised data, including card types, expiry dates and the last four digits of card numbers.

Have I Been Pwned said the breach contained more than 55 million unique email addresses, while phone numbers were exposed where they had been used as a sign-up method.

“Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data, including the card type, expiry date, and last four digits.”

Suno reportedly told Have I Been Pwned that it does not have access to customers' full credit card numbers through Stripe. The service has advised affected users to change their passwords and activate two-factor authentication where available.

The stolen data also reportedly included portions of Suno’s source code, providing insight into the material scraped from online music and lyric platforms for use in training its artificial intelligence models.

The code, which appears to date from 2023 and 2024, reportedly references more than 2 million music clips and material sourced from platforms including YouTube, Deezer and Genius. The data also included references to more than 113,000 hours of YouTube Music content, 17,000 hours of Genius material and 12,000 hours of Deezer content.

The revelations come as Suno faces legal action from major record companies over its use of copyrighted music to train its AI systems. The labels allege that the company's scraping of music did not qualify as fair use and infringed copyright.

Suno had not publicly disclosed the security incident or directly notified affected users before reports of the breach emerged. Following coverage by TechCrunch, a company spokesperson confirmed that Suno had experienced a security incident in November but did not dispute the reported number of affected users.

The incident adds to growing scrutiny of AI music companies over both data security and the sources of copyrighted material used to develop generative AI systems.