An AI music startup that helped popularize machine-generated songs is now dealing with a very different kind of leak. Hackers stole account data on 55 million Suno users and published it online, along with payment records that include physical addresses and partial credit card numbers.
The stolen data landed in Have I Been Pwned this week, where security expert Troy Hunt confirmed the scope. Email addresses make up the bulk of the dump. Phone numbers appear where users signed up without email. The Stripe payment records are the most sensitive layer: thousands of names, purchase amounts, card expiry dates, and the last four digits of payment cards are now exposed.
The same attacker also released years-old source code that allegedly documents how Suno pulled music from YouTube Music, Deezer, and Genius to train its AI models. Suno has publicly acknowledged training on publicly available music and defended it as fair use.
Record labels were already pursuing the company in court. Sony Music and Universal Music Group still have active copyright lawsuits against Suno, while Warner Music settled last year and turned its case into a commercial agreement.
Questions remain about when Suno discovered the breach and why users were not informed sooner. The company has not disclosed the timeline of the intrusion.
