Suno Breach Exposed 55 Million Email Addresses

For 237 days, 55.3 million people had no idea their email address was sitting in a stranger's copy of Suno's user database. The AI music generator was breached on November 25, 2025. The public found out on July 20, 2026, not from Suno but because Troy Hunt loaded the dump into Have I Been Pwned. Suno's line was that nothing sensitive had been taken, which is a strange thing to say about a file holding your name, your home address, your phone number and what you paid.

Key Takeaways

• Have I Been Pwned added 55,282,226 unique Suno email addresses to its database on July 20, 2026, roughly eight months after the November 2025 breach.
• Tens of thousands of Stripe payment records were exposed, carrying customer names, physical addresses, purchase amounts, card type, expiry date and the last four digits of the card.
• The attacker got in through a Suno employee's developer credentials, stolen by malware that arrived inside third party code running on that developer's laptop.
• Suno's public position was that "no sensitive personal information was compromised," a claim sitting awkwardly next to the six categories of personal data HIBP lists for the breach.
• Suno source code reviewed by 404 Media names YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound and IMSLP as training data sources, including a dataset of 2,013,545 YouTube Music clips.

What Was Actually Exposed in the Suno Breach?

Six categories of personal data, according to the Have I Been Pwned entry for Suno: email addresses, names, phone numbers, physical addresses, purchases and partial credit card data.

The bulk is email addresses, 55,282,226 of them, with phone numbers appearing where users registered with a number instead. Underneath sits a smaller and nastier layer: tens of thousands of Stripe payment records. The Register reported those hold names, physical addresses, purchase amounts, card type, expiry date and the last four digits of the card.

Full card numbers were not in there. Stripe does not expose them to the merchant, so Suno never held them to lose, which makes the one reassuring fact here a fact about Stripe rather than about Suno. For scale: 55.3 million is more people than live in Spain.

Why Did It Take 237 Days to Surface?

Because Suno did not tell anyone. TechCrunch reported that as of the July disclosure the company had not publicly disclosed the cyberattack or notified the individuals whose information was taken. Spokesperson Rachel Racusen confirmed a security incident in November 2025 and did not dispute the affected user count.

Count the gap in days rather than months and it lands differently. November 25 to July 20 is 237 days, and during every one of them the people on that list had no reason to change a password or watch for a fake Suno email. Attackers work a fresh dataset immediately. Defenders cannot start until they know, and the notification here came from a volunteer run breach index rather than the company that lost the data.

How Did the Shai-Hulud Worm Get In?

Through a developer's laptop, not through Suno's front door. Malware delivered inside third party code stole a Suno employee's developer credentials, and those credentials opened private repositories and internal databases.

The worm named in reporting on the incident is Shai-Hulud, and it broke a rule that had held for years. Supply chain attacks used to need a human at the keyboard for each new victim. Shai-Hulud does not. CISA issued an alert on September 23, 2025 over the resulting compromise of the npm ecosystem. The mechanism is brutally simple:

• A poisoned npm package runs code during install, before anyone reviews a line of it.
• That code sweeps the machine for secrets. Later waves shipped the credential scanner TruffleHog to find and validate live tokens rather than guessing.
• It enumerates every package the stolen token can publish, injects itself into each one and republishes. The blast radius grows without the attacker doing anything.
• Stolen secrets are exfiltrated to public GitHub repositories and webhook endpoints. If the worm cannot spread or exfiltrate, later variants wipe the developer's home directory.

Now line up the calendar, because no coverage of this breach seems to have. The second Shai-Hulud wave kicked off around November 21 to 24, 2025 and hit roughly 600 to 800 npm packages and more than 25,000 GitHub repositories. Suno's breach date is November 25, 2025, within days of that wave starting. Suno was not singled out. Suno was in the path.

One stolen developer credential at an AI company is a skeleton key, the same failure we covered when a single compromised account at an AI startup gave hackers the keys to Vercel. AI companies hand engineers broad access to repositories and production data because it makes them fast, and the worm collects on that decision.

Is an Email Address Really "Nothing Sensitive"?

No, and the framing only works if you look at one address in isolation rather than at 55 million joined to names, addresses and purchase records. Suno's position, reported via Pitchfork, was that "no sensitive personal information was compromised." Set that beside the HIBP entry listing names, physical addresses, phone numbers, purchases and partial card data. Both describe the same file. Only one was written by the party with something to lose.

There is a technical reason the dismissal fails. A verified email address is the join key for everything else about you, the identifier linking this dump to the last one and the next, which is how aggregated profiles get built out of individually harmless leaks. Attach a name, a home address and a card expiry date and you can write a message that reads exactly like real correspondence from Suno. Half a card is plenty of proof. We have already seen where that leads, with leaked addresses feeding a $2,000 sextortion campaign built on nothing more than a name and a working inbox.

What Did the Leaked Source Code Reveal?

A second problem entirely, with no bearing on user safety and considerable bearing on Suno's legal position. The same intrusion exposed source code that, according to 404 Media, documents where Suno's training audio came from. One file lists the pipeline sources plainly: genius_hq, youtube_music, freesound, jamendo, imp, deezer and ytm_tagged, with figures like 2,013,545 YouTube Music clips and 62,117 hours of Pond5 music.

Suno is defending a copyright suit from Universal Music Group and Sony Music Entertainment, coordinated by the RIAA, arguing fair use. It had already said publicly that it trained on "essentially all music files of reasonable quality that are accessible on the open internet." File names naming specific streaming services are a different class of evidence than that sentence. One break in produced two disclosures, and the one that dominated the music press is not the one that matters to the 55 million people in the dump.

Why Email Users Should Care

A 55 million address list does not sit still. It gets sold, merged and reused, and the first buyers send targeted phishing. What makes this dump valuable is the context riding alongside each address: a real name, a real home address, a real purchase amount and the last four digits of the card that paid it. A phishing email quoting your actual last payment and the right four digits does not look like phishing. It looks like billing.

The second exposure is credential stuffing, which depends on password reuse rather than anything in the dump. Attackers take addresses from one breach and test them against passwords harvested elsewhere, and the raw material is abundant. We looked at 48 million Gmail logins surfacing in an infostealer database and at 24 billion credentials in a single infostealer dump. If your Suno password is one you use elsewhere, this breach hands someone the other half of a pair.

There is a quieter tail too. An address confirmed as live and attached to a paying customer is worth more to a list broker than a cold one, so the marketing mail aimed at it rises, and with it the remote images quietly reporting when you read what they sent. Not the emergency here. Just the part that never ends.

What Should You Do Right Now?

Five things, in order, and the first one takes ten seconds.

• Check the dump. Search your address on Have I Been Pwned. Check the old addresses too, not just the one you use now.
• Change the Suno password, and anywhere you reused it. The reuse is the real exposure. If you cannot remember every site sharing that password, that is the answer, and a password manager fixes it permanently.
• Turn on two factor authentication. An app based code or a hardware key beats SMS, since your phone number was in this breach too.
• Distrust Suno themed email for a while. Anything about billing, refunds, expiring cards or account suspension deserves suspicion, especially when it quotes details that look correct. Type the address into your browser instead of clicking. Suno never emailed anyone about the breach, so a message claiming to be about it is a bad sign on its own.
• Use a unique alias per service from here. Address tagging or a masked forwarding address means the next dump burns one alias rather than your identity, and it tells you who leaked you.

Watch the card statement for a few months too. Partial card data will not let anyone charge you, but it makes an impersonation script far more convincing over the phone.

The Bottom Line

Suno lost 55.3 million email addresses to a worm nobody aimed at them, said nothing for 237 days, then said nothing sensitive was involved. Every part of that sequence is now normal, which is the discouraging bit. The company that loses your data is rarely the one that tells you, the way in is increasingly a developer's laptop rather than a server, and "just an email address" keeps being the phrase companies reach for while the address quietly ties every other leak about you together.

Sources: Have I Been Pwned, Suno breach entry, The Register, AI music platform Suno hits bum note as 55M users exposed, TechCrunch, AI music generator Suno breach affects 55M users, 404 Media, Hack reveals Suno scraped YouTube, Deezer and Genius, CISA, Widespread supply chain compromise impacting npm ecosystem, and Unit 42, Shai-Hulud worm compromises npm ecosystem.