Suno has been hit with another proposed class action over the November 2025 data breach that reportedly exposed the personal information of 55.3 million users.
The complaint was filed earlier this month (September 3) in the US District Court for the District of Massachusetts, where Suno is headquartered.
The named plaintiff is Michael Beckham, whom the filing describes as an adult domiciled in Huron, South Dakota.
You can read the Beckham complaint in full here.
Beckham says he created a Suno account using his Gmail address no later than the summer of 2024, and that breach-notification service Have I Been Pwned identified that address as included in the stolen Suno dataset.
The suit arrives 10 days after US District Judge Allison D. Burroughs consolidated the two earlier data breach class actions against Suno into a single case.
That order, entered on August 24, designated Pilavian v. Suno, Inc. as the lead case and Rugnetta v. Suno, Inc. as the member case, and directed the clerk to administratively close the latter.
Plaintiffs in the consolidated case have 30 days from that order to file a consolidated complaint, and Suno then has 45 days to respond.
Suno‘s deadlines to respond to the two separate complaints were stayed by the same order.
Beckham‘s complaint states that his action is related to the Pilavian case, and that he “will file the required related-case materials and anticipates that coordinated proceedings or consolidation will promote efficiency, avoid inconsistent rulings, and conserve judicial and party resources.”
The new case brings claims for negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment, and declaratory and equitable relief against Suno.
The filing seeks damages; complete individualized notice of the information affected; identity-theft, phishing, and account-protection services for “not less than five years”; and prospective security, retention, and deletion measures.
It proposes a nationwide class covering everyone in the United States whose email address or other personal information was included in the dataset obtained from Suno, plus a South Dakota subclass, and puts the aggregate amount in controversy above USD $5 million.
Citing Have I Been Pwned, the complaint says the breached dataset held “approximately 55.3 million unique email addresses,” phone numbers where those were used as the sign-up method, and “tens of thousands of Stripe purchase records” containing names, physical addresses, purchase amounts, card type, expiration date, and the last four digits of payment cards.
“The incident was not a speculative exposure or a misplaced device,” the Beckham complaint alleges.
Beckham says he has spent approximately 10 hours responding to the breach, and that he has seen an increase in unsolicited spam telephone calls and phishing attempts since it occurred. “Plaintiff’s mitigation time is a present injury,” the complaint states.
It alleges that Suno has not given Beckham a disclosure identifying which fields tied to his account were accessed or taken. “The absence of timely, complete, and individualized information impaired Plaintiff’s ability to take targeted protective action,” the filing alleges.
“The precise attack vector, dwell time, systems traversed, privileges obtained, data queried, files exported, and security controls bypassed are known principally to Suno and its forensic investigators and will be developed through discovery,” it states.
It cites Suno‘s statement that it has implemented “commercially reasonable security measures and safeguards,” and alleges that “the Data Breach and delayed disclosure plausibly show that the measures in place at the relevant time were not reasonable or were not reasonably implemented.”
Suno‘s Privacy Notice, last modified on June 23, 2026, states: “While we have implemented commercially reasonable security measures and safeguards intended to protect your personal information, no measures are impenetrable and we cannot guarantee ‘perfect security.'”
The complaint also addresses a possible arbitration defense, stating that Beckham does not concede that Suno gave reasonably conspicuous notice of any arbitration agreement, class waiver, delegation clause, limitation period, or liability cap.
Responding to the first of the data breach suits in July, a Suno spokesperson told MBW: “We are reviewing this complaint. Trust is the foundation of any product people use every day and we take safeguarding our community’s data security extremely seriously.
“In November of 2025, we experienced a security incident that was quickly contained.”
The spokesperson said the incident “primarily involved outdated source code and a limited amount of information associated with certain users,” that Suno does not store full payment card information or collect bank account details, and that the company had hired a third-party cybersecurity expert to audit its initial findings.
The scale of the breach became public when Have I Been Pwned added the dataset to its database on July 20, and TechCrunch reported the following day that Suno had confirmed a security incident in November 2025 and did not dispute the number of users affected.
Suno said at the time that it had concluded individual breach notifications “were not warranted under applicable privacy laws.”
That left roughly eight months between the breach and its public disclosure, as MBW has reported.
The Cambridge, Massachusetts-based company raised over $400 million in a Series D round in June that valued it at $5.4 billion.
CEO and co-founder Mikey Shulman said in February that more than 100 million people had used the service.
Suno is separately defending copyright infringement claims from Universal Music Group and Sony Music Entertainment in the same court, in litigation coordinated by the RIAA and first brought in 2024.
Warner Music Group settled with Suno in November 2025 and entered a licensing partnership that included Suno‘s acquisition of concert-discovery platform Songkick.
The Beckham complaint was filed by Stephen J. Teti of Lockridge Grindal Nauen PLLP in Boston, with Kate M. Baxter-Kauf, Karen H. Riebel, and Jacob E. Lanthier of the firm’s Minneapolis office listed with admission pro hac vice forthcoming.Music Business Worldwide