Suno faces class action over 55.3 million-user data breach

The lawsuit, filed on 24 July in the US District Court for the District of Massachusetts, where Suno is headquartered, alleges that the company failed to adequately protect customers’ personal information and did not notify affected users about the breach.

The breach, which reportedly occurred in November 2025, was recently reported by 404 Media. According to Have I Been Pwned, the incident exposed information linked to 55.3 million people, including names, physical and email addresses, phone numbers, purchase histories and partial payment card details, including expiry dates.

The proposed class action names Florida resident and Suno customer Alec Pilavian as the lead plaintiff. He is seeking to represent US users whose information was allegedly compromised.

The complaint alleges that Suno prioritised profits over data security by using what it describes as inadequate security measures. It also claims that the company “has not provided, and does not appear to have provided, any notice regarding the data breach”.

The lawsuit states that affected customers have been “left to speculate as to where their [information] ended up, who has used it, and for what potentially nefarious purposes”.

Suno said it was reviewing the complaint and confirmed that it had experienced a security incident in November 2025.

“We are reviewing this complaint,” a Suno spokesperson said. “Trust is the foundation of any product people use every day, and we take safeguarding our community’s data security extremely seriously. In November of 2025, we experienced a security incident that was quickly contained.”

The company said a subsequent investigation found that the incident “primarily involved outdated source code and a limited amount of information associated with certain users”. Suno also said it does not store customers' full payment card information or collect bank account details.

“We also hired a third-party cybersecurity expert to audit our initial findings,” the spokesperson said. “We know any security incident can be alarming. As Suno continues to grow, we are continuing to invest in our security programme and the team behind it.”

The lawsuit alleges negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment and declaratory judgement. It seeks damages of more than $5 million, as well as an order requiring Suno to strengthen its data security measures and provide affected users with at least 10 years of credit monitoring services.