A cyberattack at AI music generator Suno last year allowed a hacker to steal the personal information of more than 55.3 million people, according to the data breach notification service Have I Been Pwned, offering the first glimpse into the scale of the data theft.
Per Have I Been Pwned, which obtained a copy of the breached dataset, the stolen data included customers’ names, physical addresses and email addresses, phone numbers, purchases, and partial payment card numbers taken from the company’s Stripe account, including card expiry dates.
The breach happened in November 2025, but was only recently revealed thanks to reporting by independent news outlet 404 Media.
The data theft also included Suno’sons of songs and lyrics from popular streaming sites, including Deezer, Genius, and YouTube, to train its AI models. Several major record labels are currently suing Suno, claiming that its mass-scraping efforts violate copyright law
Suno has not yet publicly disclosed the cyberattack, or notified individuals that their information was taken. Suno co-founder Mikey Shulman did not respond to TechCrunch’s request for comment about the incident.
After publication, Suno spokesperson Rachel Racusen did not dispute the number of users affected, and confirmed that the company experienced a security incident in November 2025. It’s not clear why the company has not yet publicly acknowledged the data breach on its website. Nor did the company provide TechCrunch, when asked, with any communication the company may have sent to users informing them of a data breach.
Updated with comment from Suno.
