Suno suno.com Suno data breach: what happened and what to do
In November 2025, AI music tool Suno suffered a breach that came to light in July 2026. Have I Been Pwned counts 55.3 million email addresses, plus phone numbers and tens of thousands of Stripe purchase records with names, addresses and partial card data.
View all 13,115 breaches- Breach date
- 25 Nov 2025
- Affected
- 55,282,226
- Data exposed
- Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Suno is an AI music generation service. In November 2025 it suffered a data breach that only came to light in July 2026, when 404 Media reported on a hack that exposed Suno's data and source code. Have I Been Pwned added the breach on July 20, 2026.
According to Music Business Worldwide and other coverage, the hacker said they got in through a Suno employee infected with a worm that steals GitHub and cloud credentials. Suno has said the incident mainly involved outdated source code that is no longer in use, and that no sensitive personal information was compromised. It decided individual notifications were not warranted under privacy law, and some affected customers say they were never told.
How many people
Have I Been Pwned counted 55,282,226 unique email addresses, about 55 million. It is among the larger consumer breaches of 2026, and it is a count of email addresses.
What was exposed
Have I Been Pwned lists email addresses, names, partial credit card data, phone numbers, physical addresses and purchases. Most records are email addresses. Phone numbers are present where people used a phone number to sign up.
A much smaller set, tens of thousands of records, came from Stripe, the payment processor, and holds names, physical addresses, purchase amounts and partial card data: card type, expiry date and the last 4 digits. Suno says it does not have access to customers' full card numbers in Stripe, so a full card number is not part of the data.
What that lets criminals do
An email address on a list of 55 million is useful mainly to phishers, who can write to anyone who has a Suno account. A message about a Suno subscription, credits or a copyright claim is plausible to someone who uses the service.
For the smaller group with Stripe records, a name, address and the last 4 digits and expiry of a card can make a fake "billing problem" email much more convincing. The last 4 digits and expiry are not enough to charge a card, but they are what a caller uses to sound like your bank.
The company's response
Suno disputes how serious the breach was and says sensitive information was not compromised. Whether or not you accept that, the exposure of email addresses and some payment details is documented in Have I Been Pwned's entry. The company has said it will not notify each person individually.
If you have a Suno account
Assume your email address is in the data. Check Have I Been Pwned and watch for billing or subscription messages. If you paid Suno by card, look at your statements for charges you don't recognize.
What to do if you were in it
- 1
Treat Suno billing and subscription emails with suspicion
Fake messages about credits, a failed payment or a copyright claim are likely. Go to the Suno site directly instead of using a link.
- 2
Check your card statements
If you paid Suno by card, look for charges you don't recognize. Partial card data leaked for some people, so tell your card issuer if something looks wrong.
- 3
Don't give card details to anyone who calls
A caller may quote the last 4 digits and expiry of your card to sound real. Hang up and use the number on the back of your card.
- 4
Be careful with texts if you signed up by phone
Phone numbers are in the data for people who used one to register. Don't click links in unexpected texts.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears. It can't take data out of a breach, but it shows you what leaked and what to do about it.
Frequently asked
Was I affected by the Suno breach?
If you ever had a Suno account, possibly. Search your email on Have I Been Pwned, which holds 55.3 million email addresses from the breach.
What was exposed?
Have I Been Pwned lists email addresses, names, partial credit card data, phone numbers, physical addresses and purchases. The card data covers type, expiry and last 4 digits only.
Were full credit card numbers exposed?
No. Suno says it does not have access to customers' full card numbers in Stripe, and Have I Been Pwned lists only partial card data.
Should I change my password?
Passwords are not listed among the exposed data. If you reuse your Suno password elsewhere, change it anyway and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
