Suno Waited Eight Months to Tell 55 Million Users About a Data Breach

In November 2025, a hacker using the name ellie.191 infected a Suno employee’s device with Shai-Hulud, a supply-chain worm that steals GitHub and cloud-service credentials, and used those credentials to access Suno’s internal systems. The attacker walked away with the personal data of more than 55 million users and the company’s source code. Suno determined it had been breached, conducted an internal investigation, concluded that “no sensitive personal information was compromised,” and told no one. Eight months later, breach notification service Have I Been Pwned added 55,282,226 unique email addresses from Suno’s systems to its database on July 20, after independent outlet 404 Media broke the story on July 15. The public learned about the breach from a data breach monitoring service and an independent reporter. Not from Suno.

The scope of what was exposed is broader than Suno’s initial characterization suggested. According to Have I Been Pwned and reporting by TechCrunch, the stolen dataset contained more than 55 million unique email addresses, phone numbers where users had provided them at sign-up, and tens of thousands of Stripe purchase records containing customers’ names, physical addresses, purchase amounts, and partial payment card details including card type, expiry date, and the last four digits of the card number. Roughly 24% of the email addresses had already appeared in previous breaches, meaning the remaining 76% were new additions to the compromised record. Suno told 404 Media it does not have access to customers’ full credit card numbers in Stripe, which is accurate but does not address the physical addresses, names, and purchase histories that were also in the dataset.

Suno’s explanation for why it did not notify users is worth examining carefully. A spokesperson told 404 Media that the company “immediately conducted an investigation and verified that the incident primarily involved outdated source code that is no longer in use at Suno and that no sensitive personal information was compromised,” and that individual breach notifications “were not warranted under applicable privacy laws.” After TechCrunch published its report on July 21, spokesperson Rachel Racusen did not dispute the 55 million figure and confirmed the security incident, but the company had not publicly acknowledged the breach on its own website and did not provide TechCrunch with any communication it may have sent to users. The gap between “outdated source code” and 55 million exposed records is not a small one, and cybersecurity experts have noted that physical addresses and purchase records are exactly the category of data that consumer privacy statutes in states including California were designed to protect.