Suno breach hit 55.3M users — names, addresses, partial cards, and training-scrape source code

AI music’s breakout app just became a breach headline with a body count. Have I Been Pwned, citing a copy of the stolen dataset, says a November 2025 cyberattack on Suno exposed personal information for more than 55.3 million people — names, physical addresses, emails, phone numbers, purchase history, and partial payment-card numbers plus expiry dates from Stripe. 404 Media’s reporting cracked the story open; TechCrunch confirmed Suno does not dispute the user count.

The source-code problem

Beyond PII, thieves took Suno source code that reportedly documents how the company scraped millions of songs and lyrics from streaming and lyric sites including Deezer, Genius, and YouTube to train models. Major record labels are already suing Suno over copyright. A spokesperson confirmed a November 2025 security incident after publication; public user notification still looked thin relative to the scale HIBP described.

Same week, same industry

Pair this with Deezer saying more than half of daily uploads are AI-generated, and Spotify’s ongoing war on AI “slop,” and July 2026 is the month music platforms stopped pretending generative audio was a side quest. If you ever made a Suno account, rotate passwords, watch financials, and assume the scrape logs are now someone else’s dataset.

Report: TechCrunch — Suno breach affects 55M users.

Generate a song in seconds. Spend years cleaning up the breach. That is the 2026 AI music bargain.