Suno breach exposed millions of users’ names, phone numbers and addresses

Suno’s breach exposed more than 55 million unique email addresses, along with phone numbers used at sign-up and purchase records that included names, physical addresses and partial payment information. The stolen data traced back to a November 2025 incident that surfaced publicly in July 2026, putting millions of users at risk of stalking, fraud and identity theft.

Have I Been Pwned said the exposed corpus also contained tens of thousands of Stripe records relating to purchases. Even though those records made up a smaller slice of the data, the combination of names, home addresses and payment details is the kind of package criminals can use to target people with phishing, impersonation scams and account takeover attempts. Suno said it was breached in November and that "no sensitive personal information was compromised."

The exposure lands hard because Suno is not a niche tool. The AI music generator has apps on both the Apple App Store and Google Play, and it has built a public profile from Cambridge, Massachusetts, as one of the best-known consumer-facing music platforms in the field. When a service like that holds email addresses, phone numbers and billing records at this scale, a breach stops being an abstract cybersecurity problem and becomes a direct privacy threat to ordinary users.

The incident also sits inside a larger fight over how Suno built its product. Hacked source code and related files showed the company scraped YouTube, Deezer and Genius for training data, deepening questions about how the company gathered material for its models. Suno was already facing legal pressure from Universal Music Group, Sony Music and a Hagens Berman class action alleging unauthorized use of independent artists’ songs to train its systems.

The OECD AI incident tracker logged the Suno episode as an AI incident dated 2026-07-11, underscoring how quickly a fast-growing consumer AI company can become a high-value target once it accumulates millions of accounts and payment records. Troy Hunt, who created Have I Been Pwned, said the Suno data surfaced publicly and was then added to the breach database.