← Suno

2025 Suno — Shai-Hulud supply-chain breach; source code + customer data (Nov; disclosed Jul 2026)

2025 Unknown records affected Share on X

Data compromised

Per 404 Media / TechCrunch / TechTimes summarizing hacker 'ellie.191' and company response: customer emails, phone numbers, and Stripe payment information (partial card numbers cited by press; Suno says it does not retain full card numbers) for hundreds of thousands of users—exact headcount not attested. Also private source code (2023–2024) detailing training-data pipelines (YouTube Music, Pond5, Deezer, Genius, podcasts, etc.). Company called exposed code 'outdated' and said no sensitive personal information was compromised.

Technical writeup

Company-acknowledged security incident with July 2026 press disclosure — November 2025. AI music generator Suno (Cambridge, Massachusetts) was breached after a hacker operating as 'ellie.191' told 404 Media they leveraged the Shai-Hulud npm supply-chain worm to obtain employee credentials, then accessed private GitHub repositories and cloud services. Material shared with journalists included 2023–2024 source code documenting training-data ingestion tallies (e.g., 113,879 hours of YouTube Music, 62,117 hours of Pond5, 12,287 hours of Deezer, Genius lyrics/audio hours, plus a podcast pipeline aiming at roughly one million hours) and customer data the hacker said covered emails, phone numbers, and Stripe payment fields for hundreds of thousands of users. TechCrunch reported Suno described a 'limited security incident that was quickly contained,' characterized the code as outdated/no longer in use, and said formal user notification was unnecessary because it does not retain full credit card numbers—while users who spoke with 404 Media said they received no breach notices. BreachHistory indexes this separately from the October 2025 JWT/IDOR disclosure (suno2025) and sets recordsAffected 0 pending an attested customer count.

Root cause

Shai-Hulud npm worm / supply-chain compromise harvested employee credentials used to access private GitHub repositories, cloud services, source code, and customer/payment-related data (per hacker account to 404 Media)

References

Breaches you may like