Suno, an AI music generation company, experienced a significant data breach in November 2025 that went unannounced until July 2026. The compromise exposed personal information for over 55 million users, including email addresses and phone numbers, along with tens of thousands of payment records from Stripe containing customer names, addresses, and partial credit card details. The company initially deemed the breach minor and determined that user notification was not legally required, maintaining silence for eight months until independent reporting revealed the scale of the exposure.

The same security incident also leaked Suno's source code, which documented the company's AI model training methodology. The code revealed that Suno had systematically scraped music and lyrics from multiple platforms including YouTube Music, Deezer, Genius, and stock libraries, accumulating hundreds of thousands of hours of audio material. This disclosure provided transparent evidence of how the company sourced training data for its AI models, raising questions about artist consent and music licensing practices.