Overview
- The breach, which occurred in November 2025, was publicly revealed in July 2026 after 404 Media reported the leak and Have I Been Pwned published an analysis showing 55.3 million unique affected accounts.
- Have I Been Pwned’s copy of the stolen dataset included names, email addresses, phone numbers, physical addresses, purchase histories and tens of thousands of Stripe records with partial payment details such as card type, expiry and last four digits.
- Suno has confirmed the November incident while saying the exposed material was outdated source code, that full card numbers were not stored because payments used Stripe, and that it treated the event as a limited, contained incident.
- The leaked source code, dated to about 2023–2024, lists scraped sources including YouTube Music, Deezer, Genius and multiple stock libraries and shows clip/hour counts that could strengthen pending RIAA and label lawsuits over unlawful scraping.
- Security reporting ties the intrusion to a claimed supply‑chain credential compromise by an actor using a Shai‑Hulud worm, and the combined data and code raise clear risks of targeted phishing, tighter disclosure rules, and renewed calls for licensed, provenance‑based AI training data.