A hacker has compromised the personal data of over 55 million users of Suno, the AI-powered music generation platform, in what ranks among the largest consumer data exposures in the AI industry to date. The breach included names, phone numbers, physical addresses, purchase histories, and partial payment card details.
The breach happened in November 2025. It wasn’t publicly disclosed until July 2026. That’s an eight-month gap between the incident and disclosure.
What was exposed and why it matters
The compromised records span over 55 million unique email addresses. The leaked data included names, physical addresses, phone numbers, purchase history, and partial payment card details.
Suno characterized the breach as involving “outdated source code” and claimed it did not necessitate user notifications under applicable privacy laws.
The source code problem is arguably worse
The breach also exposed Suno’s internal source code. The leaked source code reportedly documents mass scraping of copyrighted music and lyrics from various platforms. This is significant because Suno is already facing copyright litigation from major record labels over allegations of unauthorized use of copyrighted material for training purposes.
What this means for the AI and crypto intersection
Several crypto-native music platforms have positioned themselves as alternatives to centralized AI music generators, using blockchain-based royalty tracking and transparent training data attribution. If Suno’s copyright problems intensify because of the leaked source code, it could accelerate adoption of platforms that can cryptographically prove their training data was properly licensed.
If authorities decide Suno violated notification requirements, it could trigger stricter breach disclosure rules across the AI industry.