Suno data breach exposes 55M accounts, claims security expert

Key Takeaways

• Have I Been Pwned confirmed 55 million Suno accounts were exposed, including emails, phone numbers, and partial payment data
• The breach also revealed source code allegedly showing Suno scraped music from YouTube Music, Deezer, and Genius for AI training
• Warner Records has settled its copyright lawsuit and partnered with Suno, while Sony and UMG continue litigation

AI music generator Suno has exposed more than 55 million user accounts in a data breach, according to Troy Hunt's Have I Been Pwned service. The dump included email addresses, phone numbers, and tens of thousands of Stripe payment records containing names, physical addresses, purchase amounts, and partial credit card information.

This is the first time a concrete figure has been attached to the breach since news of the incident surfaced last week. Suno, which lets users generate songs from text prompts, has not responded to requests for comment.

What data was exposed in the Suno breach?

Have I Been Pwned's breakdown shows the breach consisted primarily of email addresses. Phone numbers were also exposed where users had registered with them instead of email. The more sensitive portion involves Stripe records, which revealed card type, expiry date, and the last four digits of card numbers. That's not enough to commit payment fraud directly, but combined with names and physical addresses, it gives attackers a strong foundation for phishing and identity theft.

For CIOs evaluating the risk, the Stripe data is the concern. Partial card data paired with billing addresses is exactly what social engineers use to impersonate banks or payment processors. Any employee who used a corporate card or corporate email to sign up for Suno should be flagged for monitoring.

Breach also reveals alleged scraping source code

The individual who claimed responsibility for breaching Suno also supplied source code allegedly dating from 2023 and 2024. According to the attacker, the code shows Suno scraping millions of songs and lyrics from YouTube Music, Deezer, and Genius to train its AI models.

Suno has previously acknowledged training on music available on the open internet, arguing this constitutes fair use. That argument remains untested in court. Major record labels, represented by the Recording Industry Association of America, sued Suno and rival Udio in 2024 for allegedly scraping songs without permission. Plaintiffs included Sony Music Entertainment, UMG Recordings, and Warner Records, representing artists like Bruce Springsteen, Beyoncé, Taylor Swift, and Dua Lipa.

Warner has since settled its lawsuit and formed a commercial partnership with Suno. Sony and UMG are pressing forward with their claims.

Why AI music platforms carry elevated security risk

Consumer AI tools have grown explosively in the past two years. Suno's 55 million user base makes it comparable in scale to enterprise SaaS platforms, but it almost certainly lacks the security budgets of a Salesforce or a ServiceNow. Rapid user growth often outpaces security investment, and AI startups are notorious for prioritizing model development over infrastructure hardening.

The breach also raises questions about what else was stored. Source code from two years ago suggests the attacker had deep access. If internal systems, API keys, or training datasets were also exfiltrated, the damage extends beyond user privacy into intellectual property and potential regulatory violations.

What the Warner settlement signals

Warner's pivot from litigation to partnership is notable. It suggests at least one major label sees more value in licensing AI music tools than fighting them. For IT leaders evaluating generative AI vendors, the settlement pattern matters. Tools that cut licensing deals become lower-risk procurement choices. Tools still facing active litigation carry headline risk and potential service disruption if courts rule against them.

Sony and UMG continuing their cases means the fair-use argument remains contested. Any enterprise using Suno-generated content commercially should consult legal counsel on indemnification and liability.

Immediate steps for affected users

• Check Have I Been Pwned to confirm exposure
• Reset passwords on Suno and any accounts sharing those credentials
• Monitor bank and card statements for unusual activity
• Be skeptical of emails or calls referencing recent purchases or account details

For enterprise IT, this is also a reminder to audit shadow SaaS. AI tools like Suno, Midjourney, and ChatGPT often enter organizations through individual employees experimenting on personal time. If those employees used work emails or corporate cards, the company's attack surface just expanded without anyone in security knowing.

Frequently Asked Questions

How many users were affected by the Suno data breach?

Have I Been Pwned confirmed 55 million user accounts were exposed, making it one of the larger breaches of an AI platform to date.

What personal data was leaked in the Suno breach?

Email addresses, phone numbers, and Stripe payment records including names, physical addresses, purchase amounts, card type, expiry dates, and the last four digits of card numbers.

Is my credit card at risk from the Suno breach?

The breach exposed partial card data, not full card numbers. This limits direct fraud risk but increases phishing risk, as attackers can use the partial data to appear legitimate.

Did Suno scrape copyrighted music to train its AI?

The attacker claims leaked source code shows scraping from YouTube Music, Deezer, and Genius. Suno has acknowledged training on open internet music but argues this is fair use. Major labels are suing over the practice.

Has Suno commented on the data breach?

Suno has not responded to media requests for comment as of July 21, 2026.

Source: www.theregister.com