Security researcher Troy Hunt's Have I Been Pwned service has confirmed, for the first time, the scale of a data breach at AI music generator Suno, putting the figure at more than 55 million user accounts after ingesting the leaked files. The confirmation follows reports of the breach last week and gives concrete numbers to what had previously been an unverified claim, underscoring the severity of the incident for a rapidly growing AI platform.

The leaked data consists mainly of email addresses and, where used at sign-up, phone numbers, while tens of thousands of Stripe payment records also expose names, physical addresses, purchase amounts and partial card details such as card type, expiry date and the last four digits. Whoever claimed the breach also released Suno source code from 2023–24 allegedly showing the company scraping songs and lyrics from YouTube Music, Deezer and Genius to train its AI; Suno says this constitutes fair use of publicly available music. The episode adds fresh scrutiny to a legal battle in which Sony Music, UMG and Warner Records sued Suno and rival Udio in 2024 over alleged mass scraping, with Warner having since settled while Sony and UMG continue their claims.