A cyberattack at AI music generator Suno last year allowed a hacker to steal the personal information of more than 55.3 million people, according to the data breach notification service Have I Been Pwned, offering the first glimpse into the scale of the data theft.
Per Have I Been Pwned, which obtained a copy of the breached dataset, the stolen data included customers’ names, physical addresses and email addresses, phone numbers, purchases, and partial payment card numbers taken from the company’s Stripe account, including card expiry dates.
The breach happened in November 2025, but was only recently revealed thanks to reporting by independent news outlet 404 Media.
The data theft also included Suno’s source code, which revealed how the company allegedly scraped millions of songs and lyrics from popular streaming sites, including Deezer, Genius, and YouTube, to train its AI models. Several major record labels are currently suing Suno, claiming that its mass-scraping efforts violate copyright law.
Suno has not yet publicly disclosed the cyberattack, or notified individuals that their information was taken. Suno co-founder Mikey Shulman did not respond to TechCrunch’s request for comment about the incident.