AI music company Suno is facing two class action lawsuits over a data breach that exposed personal information tied to 55.3 million users, Complete Music Update reported. The breach happened last November but only came to light after reporting by 404 Media; data breach monitor Have I Been Pwned subsequently confirmed hackers had gained access to Suno's servers. One of the lawsuits alleges Suno stored user data in a "negligent and/or reckless manner," and that the risk of this kind of attack "was a known risk" the company was on notice about.
According to Have I Been Pwned, the stolen data included names, addresses, email addresses, phone numbers, purchase histories and partial payment card details. One of the lawsuits argues the exposure leaves users "at a significantly increased and certainly impending risk of fraud, identity theft, intrusion of their privacy," and that they will now have to "devote substantially more time, money and energy to protect themselves" from the fallout.
Suno has never formally notified affected users of the breach. A spokesperson confirmed to reporters that a cybersecurity incident occurred last November only after the 404 Media story surfaced, and one of the lawsuits notes that users "were wholly unaware of the data breach for nine months" before it became public. All 50 US states have some form of data breach notification law, according to guidance from law firm Ropes & Gray, though requirements vary by state; companies with customers in the EU or UK also face a 72-hour notification window to regulators under GDPR.
The two lawsuits were filed by Suno users Frank Rugnetta and Alec Pilavian in Massachusetts, where the company is based, and both seek class action status on behalf of affected US users. The claims accuse Suno of negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and unjust enrichment.
The breach adds a data-security dimension to a company already facing a stack of copyright lawsuits from record labels over how it trained its AI models. Reporting on the hack also surfaced Suno's source code, which reportedly showed the company had scraped songs and lyrics from platforms including Deezer, Genius and YouTube, a detail more relevant to those separate copyright cases than to the data-breach litigation itself.
The facts
- Two class action lawsuits filed against Suno over a data breach
- Breach happened in November of the prior year but only came to light through reporting by 404 Media
- Data breach monitor Have I Been Pwned found data tied to 55.3 million Suno users was accessed
- Stolen data reportedly included names, addresses, emails, phone numbers, purchase histories and partial payment details
- Suno never formally notified affected users of the breach
- Lawsuits filed by users Frank Rugnetta and Alec Pilavian in Massachusetts, where Suno is based
- Users reportedly went unaware of the breach for nine months before it became public
How this checks out
Single source
Reported by a single outlet
Only one outlet has reported it so far, so it stays a single source.
Cited sources 1
Every outlet that reported this, linked to what it published. Equal credits, in alphabetical order.