Suno has been hit with a proposed class action lawsuit over a data breach that reportedly exposed the personal information of 55.3 million users.
The suit was filed on Friday (July 24) in the US District Court for the District of Massachusetts, where Suno is headquartered.
The named plaintiff is Alec Pilavian, a Florida resident and Suno customer who is seeking to represent everyone in the United States whose data was compromised in the breach.
You can read the lawsuit in full here.
A Suno spokesperson told MBW in a statement: “We are reviewing this complaint. Trust is the foundation of any product people use every day and we take safeguarding our community’s data security extremely seriously. In November of 2025, we experienced a security incident that was quickly contained.”
“Trust is the foundation of any product people use every day and we take safeguarding our community’s data security extremely seriously. In November of 2025, we experienced a security incident that was quickly contained.”
Suno spokesperson
They added: “Subsequent investigation found that it primarily involved outdated source code and a limited amount of information associated with certain users, although we want to reassure our community that we do not store their full payment card information or collect bank account details. We also hired a third-party cybersecurity expert to audit our initial findings. “We know any security incident can be alarming. As Suno continues to grow, we are continuing to invest in our security program and the team behind it.”
According to the complaint, an unauthorized party accessed Suno‘s network and stole user data including names, physical addresses, email addresses, phone numbers, purchase histories and partial payment card details in or around November 2025.
The breach became public this month, when breach-notification service Have I Been Pwned added the stolen dataset to its database and reported the number of exposed records to be 55.3 million unique email addresses.
The complaint alleges that Suno knew about the incident in November 2025 but did not tell affected users, who it says learned of the breach only when it was reported publicly on July 20.
“Plaintiff and Class Members were wholly unaware of the Data Breach for nine months until public news sources disclosed the breach,” the complaint against Suno states.
It alleges that Suno “has not provided, and does not appear to have provided, any notice regarding the Data Breach.”
The filing accuses Suno of failing to implement adequate security and of putting profit ahead of data protection.
“Instead of providing a reasonable level of security that would have prevented the Data Breach, Defendant calculated to increase its own profit at the expense of Plaintiff and Class Members by utilizing cheap, ineffective security measures and diverting those funds to its own personal use,” Pilavian‘s complaint alleges.
The complaint says Pilavian and other users now face “a significantly increased and certainly impending risk of fraud, identity theft, intrusion of their privacy, and similar forms of criminal mischief, risk which may last for the rest of their lives.”
The filing says Suno‘s customers are “left to speculate as to where their PII ended up, who has used it, and for what potentially nefarious purposes.”
A Suno spokesperson, Rachel Racusen, did not dispute the number of affected users and confirmed that the company had experienced a security incident in November 2025.
Responding when the breach emerged, the spokesperson said Suno had determined in November 2025 that it was “the subject of a limited security incident that was quickly contained.”
Suno said it had verified that the incident “primarily involved outdated source code that is no longer in use at Suno” and that “no sensitive personal information was compromised.”
Suno concluded that individual breach notifications “were not warranted under applicable privacy laws,” the spokesperson said.
The Cambridge, Massachusetts-based company raised over $400 million in a Series D round in June that valued it at $5.4 billion.
CEO and co-founder Mikey Shulman said in February that more than 100 million people had used the service.
Suno is also defending itself against copyright infringement claims from Universal Music Group and Sony Music Entertainment, part of litigation first brought in 2024 and coordinated by the RIAA.
That case, like the new class action, was filed in the US District Court for the District of Massachusetts.
The class action brings claims including negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment and declaratory judgment against Suno.
It seeks damages, along with a court order requiring Suno to strengthen its data security and to provide class members with “not less than ten years of credit monitoring services.”
The complaint was filed by David Pastor of Pastor Law Office in Boston, alongside Gerald D. Wells III of Lynch Carpenter.
It estimates that the proposed class numbers in the millions and that its aggregate claims exceed $5 million.Music Business Worldwide