Last year's cyberattack on AI music generation company Suno allowed hackers to steal the personal information of more than 55.3 million people, providing the first glimpse of the scale of data theft, according to data breach notification service Have I Been Pwned.
According to Have I Been Pwned, which obtained a copy of the compromised data set, the stolen data included customer names, addresses, email addresses, phone numbers, purchases, and partial payment card numbers (including card expiration dates) obtained from the company's Stripe account.
The breach occurred in November 2025, but was only recently brought to light thanks to reporting by independent news outlet 404 Media.
The data theft also included Suno's source code, which revealed how the company scraped millions of songs and lyrics from popular streaming sites such as Deezer, Genius, and YouTube to train its AI models. Several major record labels are currently suing Suno, alleging that its mass-scraping efforts violate copyright law.
Suno has not yet disclosed the cyberattack or notified him that his personal information was stolen. Suno co-founder Mikey Shulman did not respond to TechCrunch's request for comment on the incident.