A major security incident at Suno, an artificial intelligence music generation platform, has resulted in the compromise of 55.3 million user accounts, according to analysis by Have I Been Pwned (HIBP) specialists. The Suno data breach exposed email addresses, phone numbers, and payment information from the popular AI music service.
What Data Was Compromised in the Attack?
Security researchers examining the stolen database discovered 55.3 million unique email addresses among the compromised information. Phone numbers were affected only in cases where users registered with their phone number instead of an email address. Additionally, tens of thousands of records from the Stripe payment system were included in the leak.
The Stripe records contain customer names, home addresses, purchase amounts, and partial bank card details including card type, expiration dates, and the last four digits of card numbers. These findings contradict Suno’s initial statements following the breach, as company representatives claimed the incident did not affect user personal data.
How Did Hackers Access Suno’s Systems?
The breach occurred in November 2025, though it only became public knowledge recently. A hacker using the alias ellie.191 provided stolen materials to journalists at 404 Media, including Suno’s source code dated from 2023 to 2024. According to the attacker, they gained access to Suno’s infrastructure after one of the company’s employees was previously compromised during an attack by the Shai-Hulud worm.
What Did the Stolen Data Reveal About Suno’s Operations?
Analysis of the stolen data exposed Suno’s data collection practices. Developers had extensively downloaded music, song lyrics, and podcasts from YouTube Music, Deezer, Genius, and numerous other platforms. One file referenced more than 2 million clips from YouTube Music alone, with the total duration of collected audio recordings reaching hundreds of thousands of hours.
Suno representatives have previously acknowledged training their AI models on music obtained from open internet sources. However, the developers maintain that training artificial intelligence on copyrighted works falls under fair use, an American legal principle that permits the use of copyrighted material without owner consent in certain circumstances.
Source: Xakep