A cyberattack against AI music generator Suno, disclosed by Have I Been Pwned on July 20, 2026, compromised the personal and financial data of more than 55.3 million users. The breach occurred in November 2025. As of July 21, 2026, Suno had not publicly disclosed the incident or notified affected individuals.

Have I Been Pwned (HIBP), a free service that tracks data breaches and lets people check whether their own information has been compromised, obtained a copy of the breached dataset and published a breach page at haveibeenpwned.com/Breach/Suno. The stolen data included customers' names, physical addresses, email addresses, phone numbers, purchase records, and partial payment card numbers with expiry dates sourced from Suno's Stripe account. Stripe is a widely used payment-processing platform. The dataset also contained Suno's source code — the underlying programming instructions that run the service.

The breach was originally revealed by independent news outlet 404 Media. TechCrunch reached out to Suno co-founder Mikey Shulman for comment; he did not respond.

The source code included in the stolen data allegedly revealed that Suno scraped millions of songs and lyrics from Deezer, Genius, and YouTube to train its AI models. Several major record labels are currently suing Suno, claiming those mass-scraping efforts violate copyright law. The exposed source code, if authenticated, could provide litigation-relevant evidence of the data sources Suno used during model training.

For anyone familiar with data security, the exposure profile is notable. Partial payment card numbers combined with expiry dates, even without full card numbers, can facilitate social engineering attacks — where attackers use stolen personal details to manipulate people into revealing more information — and credential-stuffing attacks, where stolen logins are tested against other services. The Stripe-originated payment data indicates the breach touched Suno's billing infrastructure or its connection to Stripe, not just a user-facing application database. The inclusion of source code in the stolen data raises additional concerns: proprietary model-training pipelines, scraping infrastructure, and internal architecture are now potentially accessible to whoever holds the dataset.

The eight-month gap between the breach occurring and its public surfacing is itself worth examining. Under most U.S. state breach-notification laws and the EU's GDPR (the European Union's data-protection regulation), organizations are required to notify affected individuals and regulators within defined timeframes following a breach involving personal data. Suno's apparent non-disclosure through July 2026 raises questions about regulatory exposure that go beyond the reputational damage of the breach itself.

The timing also intersects with the active copyright litigation. Several major record labels are suing Suno over its training-data practices, and the alleged scraping details surfaced through the breach could factor into that legal proceeding. Source code that documents systematic scraping from Deezer, Genius, and YouTube, if entered into evidence, would give plaintiffs concrete material to work with rather than relying on inference or third-party analysis.

The broader context here is one we have watched develop across the AI sector over the past several years. Generative AI companies face dual pressure on the data front: the data they use to train models is increasingly contested on copyright and licensing grounds, while the data they collect from users is subject to mounting regulatory and security expectations. Suno now sits at the intersection of both pressures simultaneously. A breach that exposes training-data practices during active copyright litigation is an unusually concentrated version of a risk profile that many AI companies carry in some degree.

For affected users, the HIBP breach page is the most direct way to check whether their data was included. Given that Suno has not issued its own notification, Have I Been Pwned's publication is currently the primary public channel for this information.

Looking at what this means for the AI sector more broadly, the Suno incident is a pattern that security teams at AI companies should weigh carefully. These companies often hold two categories of sensitive data: user personal and payment data, and proprietary training-data pipelines and source code. A single breach can expose both. The defensive implications are straightforward but worth stating: access controls and segmentation — keeping billing-integration data separate from source-code repositories and training-pipeline infrastructure — limit the blast radius of any single compromise. Whether Suno had such segmentation in place is not publicly known.

What is known is that 55.3 million people had their personal and partial financial data exposed in a breach their service provider chose not to disclose, and that the same breach may have handed copyright plaintiffs a clearer view of how their content was used.