Suno told the public its November 2025 breach was limited. “No sensitive personal information was compromised,” the company stated, according to Pitchfork. Have I Been Pwned disagreed. The breach monitoring service listed 55.3 million unique email addresses from Suno’s systems on July 20, 2026 — eight months after the hack. Names, physical addresses, phone numbers, purchase records, and partial payment card numbers with expiry dates were all in the dataset, according to TechCrunch. Suno has not notified tracking users of the breach.
What Got Stolen (and What Suno Wouldn’t Admit)
A supply-chain attack in November 2025 opened the vault; Suno kept the news to itself for eight months.
The breach date was November 25, 2025. Malware installed through third-party code on a developer’s laptop gave an attacker credentials to move laterally into Suno’s environment, according to TechCrunch. Mozilla Monitor independently confirmed the same breach date and scope.
The haul included user data pulled from Suno’s Stripe payment processing and source code repositories dating to 2023–2024. Here’s what was exposed:
- Names, physical addresses, email addresses, phone numbers
- Purchase records and partial payment card numbers with expiry dates
- Over 55.3 million unique email addresses confirmed by Have I Been Pwned
- Source code documenting Suno’s AI training pipeline
Suno characterized the incident as involving “primarily outdated source code that is no longer in use,” per Pitchfork. TechCrunch’s reporting directly contradicts that framing. A co-founder did not respond to comment requests.
Suno never told its users their data was stolen.
The Source Code Told a Different Story
Leaked training pipeline documentation mapped an industrial-scale scraping operation that now hands ongoing RIAA lawsuits rare, concrete evidence.
Buried inside the stolen source code was a detailed map of Suno’s training diet. The figures, reported by TechCrunch and 404 Media, are staggering:
| Source | Hours of Content |
|---|---|
| YouTube Music content | 113,879 |
| Tagged YouTube tracks | 152,162 |
| Pond5 | 62,117 |
| Deezer | 12,287 |
| Genius lyrics | 17,615 |
| IMSLP | 19,514 |
Suno also reportedly planned to ingest roughly one million hours of podcasts via PodcastIndex.
The scraping operation wasn’t casual browsing. Suno reportedly used Bright Data — a commercial surveillance app-adjacent proxy service — to route requests through rotating IP addresses, bypassing platform anti-bot protections. YouTube was targeted specifically for a cappella and vocal-only tracks. Major record labels, represented by the RIAA, have ongoing copyright lawsuits against Suno. Suno has previously argued its training on publicly available music falls under fair use. The leaked code hands those cases something rare: receipts.
What You Should Do Right Now
Independent breach services are doing the notification work Suno won’t — and right now, they’re your best warning system.
If you have a Suno account, take these steps:
- Check Have I Been Pwned today.
- Change your password. Review any linked password vaults and payment methods.
- Review any linked payment methods.
The uncomfortable reality extends well beyond one company: AI startups are moving faster than the disclosure frameworks meant to protect the people using them. Until those practices catch up, services like HIBP and Mozilla Monitor remain your most reliable — sometimes only — early warning system.
