Worm-driven breach exposes scraping of copyrighted audio; insecure systems; and ethically discordant conduct amid 55m leaked credentials and other sensitive data.
The AI music generation platform Suno has come under scrutiny after a significant data breach affecting more than 55m user accounts remained undisclosed for roughly eight months before becoming public.
The incident, which dates back to November 2025, only surfaced in mid-July 2026 when the compromised data began circulating and was subsequently indexed by Have I Been Pwned, highlighting the scale of the exposure.
Details of the breach emerged following an investigation by 404 Media, which has cited information provided by a threat actor using the alias “ellie.191.” According to the report, the attacker had gained entry through a supply-chain compromise tied to employee credentials. The intrusion had leveraged the Shai-Hulud worm, a self-propagating malware strain that began targeting the npm ecosystem in September 2025.
The worm is designed to harvest developer credentials, and it spreads laterally through infected packages, ultimately enabling access to internal systems.
Sensitive data exposed since 2025
The dataset obtained from the breach includes approximately 55.3m unique email addresses along with phone numbers associated with user accounts. In addition, tens of thousands of transaction records linked to Stripe payments have been exposed, containing customer names, billing addresses, purchase values, and partial card details such as card brand, expiration date, and the last four digits.
Suno maintains that full payment card numbers were not accessible through its systems, as those are handled directly by Stripe.
Despite the scale of the incident, Suno did not notify affected individuals at the time. The firm had reportedly described the breach as a limited event involving outdated code repositories, and has maintained that no highly sensitive personal data had been compromised. It had further argued that disclosure obligations were not triggered under applicable privacy regulations. This stance has drawn criticism from security observers, particularly given that many US data breach notification laws typically require disclosure when personally identifiable information is exposed.
On 19 July, 2026, Troy Hunt, the operator of Have I Been Pwned, had confirmed that the breached dataset had begun circulating publicly in the preceding days. The breach also had extended beyond user data, exposing internal source code that sheds light on Suno’s training data acquisition methods.
The leaked materials indicate that Suno sourced content from a wide range of platforms, including more than two million audio clips from YouTube Music, alongside substantial volumes of material from services such as Deezer and Genius, as well as stock music libraries and podcast datasets. These revelations are likely to intensify ongoing legal disputes involving major record labels, including Universal Music Group and Sony Music, both of which have accused Suno of copyright infringement.
Additionally, the underlying malware used in the attack has also raised broader concerns within the cybersecurity community. India’s Computer Emergency Response Team (CERT-In) had previously issued a high-severity warning about the Shai-Hulud worm, noting its potential to disrupt organizations dependent on npm-based development environments. The advisory had highlighted risks not only to startups but also to fintech services and government-linked digital infrastructure, underscoring the wider implications of software supply-chain vulnerabilities.
