Suno’s Data Breach Hit 55 Million Users – and the Company Said Nothing Sensitive Was Exposed

Suno told the public its November 2025 breach was limited. “No sensitive personal information was compromised,” the company stated, according to Pitchfork. Have I Been Pwned disagreed. The breach monitoring service listed 55.3 million unique email addresses from Suno’s systems on July 20, 2026 — eight months after the hack. Names, physical addresses, phone numbers, purchase records, and partial payment card numbers with expiry dates were all in the dataset, according to TechCrunch. Suno has not notified tracking users of the breach.

What Got Stolen (and What Suno Wouldn’t Admit)

A supply-chain attack in November 2025 opened the vault; Suno kept the news to itself for eight months.

The breach date was November 25, 2025. Malware installed through third-party code on a developer’s laptop gave an attacker credentials to move laterally into Suno’s environment, according to TechCrunch. Mozilla Monitor independently confirmed the same breach date and scope.

The haul included user data pulled from Suno’s Stripe payment processing and source code repositories dating to 2023–2024. Here’s what was exposed:

Names, physical addresses, email addresses, phone numbers

Purchase records and partial payment card numbers with expiry dates

Over 55.3 million unique email addresses confirmed by Have I Been Pwned

Source code documenting Suno’s AI training pipelineSuno characterized the incident as involving “primarily outdated source code that is no longer in use,” per Pitchfork. TechCrunch’s reporting directly contradicts that framing. A co-founder did not respond to comment requests.

Suno never told its users their data was stolen.

New breach: Data from Suno's November 2025 breach surfaced publicly last week. The corpus contained over 55M unique email addresses plus tens of thousands of Stripe payment records. 24% were already in @haveibeenpwned. More: t.co/RRDVGN5zFF — Have I Been Pwned (@haveibeenpwned)July 20, 2026

The Source Code Told a Different Story

Leaked…