Suno confirmed a data breach in November 2025 that exposed the personal information of 55.3 million users, according to breach-notification service Have I Been Pwned. Have I Been Pwned said it obtained a copy of the stolen dataset and added the records to its database on July 20. The breach was first reported by 404 Media on July 15, in the same investigation that exposed Suno’s source code and how the company trained its AI models. The dataset contained more than 55 million unique email addresses – 55,282,226 of them – plus phone numbers where users had provided them at sign-up. A smaller portion of tens of thousands of Stripe purchase records also held customers’ names, physical addresses, purchase amounts, and partial card details, including card type, expiry date, and last four digits. Roughly 24% of the email addresses had already appeared in previous breaches. When 404 Media broke the story on July 15, it reported the hacker had accessed information on hundreds of thousands of Suno customers; Have I Been Pwned’s listing five days later put the figure above 55 million. A Suno spokesperson said the company does not have access to customers’ full credit card numbers in Stripe. Suno determined in November 2025 it had been the subject of a limited security incident that was quickly contained, and concluded individual breach notifications were not warranted under applicable privacy laws. The company did not disclose