What came out
On July 21, 2026, TechCrunch, citing Have I Been Pwned, reported that a cyberattack on AI music generator Suno affected more than 55.3 million people. Stolen data included names, physical addresses, emails, phone numbers, purchases and partial payment card numbers (with expiry dates) from the company's Stripe account.
When and what else leaked
The incident itself happened in November 2025 and only surfaced through 404 Media reporting. Beyond personal data, the attack also allegedly took Suno's source code, which coverage said showed how the company scraped songs and lyrics from Deezer, Genius and YouTube to train models — a core issue in record-label lawsuits against Suno.
Company response
Suno had not publicly disclosed the attack or clearly notified users before the reporting. After publication, spokesperson Rachel Racusen did not dispute the number of affected users and confirmed a November 2025 security incident, without explaining the delay in user communication.
What to do
If you have a Suno account, change the password, watch cards tied to Stripe and check your email on Have I Been Pwned. For AI products with millions of users, delayed breach notification is a regulatory and trust risk.