AI music generator Suno has confirmed it suffered a data breach in November 2025, after breach-notification service Have I Been Pwned reported obtaining a dataset containing the personal information of 55.3 million users. The confirmation, first reported by TechCrunch, contradicts Suno's earlier characterisation of the incident when it surfaced on 15 July as a "limited security incident" affecting only hundreds of thousands of customers, and raises questions about whether the company adequately disclosed the breach's true scale to those affected.

The exposed dataset includes more than 55 million unique email addresses and phone numbers, alongside tens of thousands of Stripe purchase records containing names, addresses, purchase amounts and partial card details. Suno says it determined individual breach notifications were not legally required and maintains no full card numbers or "sensitive personal information" were compromised, though some affected customers say they were never told. The breach stemmed from a hack that also exposed Suno's training practices, including scraping from YouTube Music, Deezer and Genius, after an employee was compromised via the Shai-Hulud supply-chain worm. It comes as Suno, valued at $5.4 billion following a $400 million funding round, fights a copyright lawsuit from Universal Music Group and Sony Music Entertainment that could expose it to over $9 billion in damages.