A cyberattack on AI music generator Suno in November 2025 exposed the personal data of 55.3 million users, including Stripe-linked payment information. Leaked source code also confirmed that the company systematically scraped millions of songs from platforms like YouTube, Deezer, and Genius to train its artificial intelligence models.
Data Breach Details and User Impact
The security incident, which occurred in November 2025, remained undisclosed by the company until reporting by 404 Media brought the event to light. According to the data breach notification service Have I Been Pwned, which obtained a copy of the breached dataset, the stolen data encompasses the personal information of more than 55.3 million individuals.
The compromised records include customers’ names, physical addresses, email addresses, and phone numbers. Furthermore, the breach exposed purchases, partial payment card numbers taken from the company’s Stripe account, and card expiry dates. Despite the scale of the theft, Suno has not publicly disclosed the cyberattack or notified individuals that their information was taken. Suno co-founder Mikey Shulman did not respond to TechCrunch’s request for comment regarding the incident.
Training Data and Scraping Methodology
Beyond customer records, the stolen source code provides a look at the inner workings of Suno’s AI training pipeline. The leaked files, which appear to be from 2023 and 2024, explicitly detail the company’s efforts to aggregate vast quantities of audio content from across the internet, including stock music libraries like Pond5, Jamendo, Freesound, the International Music Score Library Project (IMSLP), and podcasts via RSS feeds. Developers documented specific libraries for ingestion, including genius_hq, youtube_music, freesound, jamendo, imp, deezer, ytm_tagged,
with internal notes confirming that non-music will be filtered out.
The scope of these collections is substantial. One file associated with YouTube Music indicated that, at the time of its last update, the company had ingested 2,013,545 music clips.
Another file contained comments detailing the hours of audio associated with different datasets Suno created:
- 113,879 hours of youtube_music
- 152,162 hours of ytm_tagged
- 62,117 hours of pond5_music
- 19,514 hours of imslp
- 17,615 hours of genius_hq
- 12,287 hours of deezer
- 3,726 hours of jamendo
- 410 hours of free sound
- 103 hours of musescore_lyrics
In total, this represents at least decades worth of music.
Legal Stakes for the AI Industry
The revelation that Suno relied on direct scraping of material arrives during a period of legal pressure. The Recording Industry Association of America has previously accused the firm of ripping songs directly from platforms like YouTube, a claim now substantiated by the leaked scraping instructions viewed by 404 Media.
Suno has defended its practices in court, arguing that its data usage constitutes fair use. In previous legal filings, the company admitted to training on essentially all music files of reasonable quality that are accessible on the open internet,
totaling tens of millions of recordings.
While several major record labels are currently suing Suno, one of the cases has already been settled. The hacked data serves as a rare look at exactly how AI tools are built and confirms the scale of the company’s reliance on copyrighted works.
What Remains Uncertain
While the leaked data provides technical confirmation of the company’s scraping history, several questions remain regarding the aftermath of the breach. Because Suno has not publicly acknowledged the hack, it is unclear what, if any, security remediations have been implemented since the 2025 incident. Users remain in a position of uncertainty regarding the exposure of their financial and personal details, as the company has yet to initiate a formal notification process.
Keep reading
