Full Report
In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year. The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data including the card type, expiry date and last 4 digits. The company advised that "Suno does not have access to customers' full credit card numbers in Stripe".
Analysis Summary
# Incident Report: Suno AI Data Breach
## Executive Summary
In November 2025, the AI music generation platform Suno experienced a major data breach involving the exfiltration of personal information belonging to over 55 million users. The breach remained undisclosed or undetected for approximately eight months until it surfaced publicly in July 2026. The compromised data includes PII (Personally Identifiable Information) and partial financial records related to Stripe transactions.
## Incident Details
- **Discovery Date:** July 20, 2026 (Public disclosure/HIBP entry)
- **Incident Date:** November 2025
- **Affected Organization:** Suno
- **Sector:** Artificial Intelligence / Technology / Digital Media
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** November 2025
- **Vector:** Not explicitly disclosed (Likely database vulnerability or unauthorized API access)
- **Details:** Attackers gained access to Suno’s user database and payment record corpus.
### Lateral Movement
- **Details:** Specific internal movement techniques were not disclosed in the source material, though the attacker reached both primary account databases and Stripe-integrated purchase records.
### Data Exfiltration/Impact
- **Details:** Exfiltration of a data corpus containing 55.3 million unique email addresses, phone numbers, and tens of thousands of Stripe purchase records.
### Detection & Response
- **How it was discovered:** Information surfaced publicly/via third-party reporting (404 Media / Have I Been Pwned) in July 2026.
- **Response actions taken:** Suno clarified their data handling policy regarding Stripe (confirming they do not store full card numbers) and affected users were advised to change passwords.
## Attack Methodology
- **Initial Access:** Unknown (Likely exploitation of web-facing application or cloud storage)
- **Persistence:** Not disclosed
- **Privilege Escalation:** Not disclosed
- **Defense Evasion:** Not disclosed
- **Credential Access:** Access to account database containing emails and phone numbers
- **Discovery:** Not disclosed
- **Lateral Movement:** Not disclosed
- **Collection:** Automated gathering of user profile data and transaction metadata
- **Exfiltration:** Large-scale extraction of over 55 million records
- **Impact:** Massive PII leak and exposure of financial transaction history
## Impact Assessment
- **Financial:** Exposure of tens of thousands of Stripe records (purchase amounts, card types, expiry dates, and last 4 digits).
- **Data Breach:** High. 55.3 million unique email addresses and associated phone numbers.
- **Operational:** No reported service downtime; primary impact is data integrity and privacy.
- **Reputational:** Significant; eight-month delay between occurrence (Nov 2025) and public awareness (July 2026).
## Indicators of Compromise
- **Network indicators:** None provided in the source report.
- **File indicators:** None provided.
- **Behavioral indicators:** Unusual database export activity/high-volume egress traffic (retrospective).
## Response Actions
- **Containment measures:** Details on how the breach was stopped were not provided.
- **Eradication steps:** Not disclosed.
- **Recovery actions:** Notification to users (via disclosure), advisory regarding password hygiene, and implementation of 2FA.
## Lessons Learned
- **Detection Gap:** There was a significant "dwell time" (8 months) between the breach and its discovery/disclosure, indicating a need for better anomaly detection and data egress monitoring.
- **Third-Party Integration:** While Suno correctly offloaded credit card processing to Stripe (minimizing financial risk), the exposure of partial Stripe metadata still provides attackers with targets for sophisticated phishing.
- **Data Minimization:** Evaluating whether the storage of physical addresses and purchase history was necessary for all compromised records.
## Recommendations
- **Implement Egress Monitoring:** Deploy tools to alert on massive data transfers from production databases to unauthorized external IPs (e.g., hxxps[://]404media[.]co).
- **Mandatory MFA:** Enforce Multi-Factor Authentication for all 55M+ users to mitigate the risk of credential stuffing following the email/phone leak.
- **Encryption at Rest:** Ensure all PII, including physical addresses and phone numbers, are encrypted at rest to provide a secondary layer of defense.
- **Regular Security Audits:** Conduct quarterly penetration testing on API endpoints and cloud-hosted databases.