Suno Issues Official Statement on Data Breach, Calling Exposure 'Limited' as Two Class Action Lawsuits Follow
Following the July 21, 2026 report of a Suno data breach (which occurred in November 2025 and reportedly affected more than 55.3 million people), Suno has now issued an official statement on the incident. However, the company’s characterization of the exposure as “limited” is being challenged by two class action lawsuits filed in Massachusetts federal court over the delayed disclosure.
Details
- Suno’s official statement: The company said “subsequent investigation found that it primarily involved outdated source code and a limited amount of information associated with certain users,” adding that it does not store full payment card information or collect bank account details
- Third-party audit: Suno says it hired an outside cybersecurity firm to audit its initial findings
- Gap with Have I Been Pwned’s figures: While Have I Been Pwned puts the number of affected people at more than 55.3 million, Suno’s own description of the breach as involving only “limited” information suggests a narrower view of its scope
- Lawsuit #1: Filed July 24 in the U.S. District Court for the District of Massachusetts by Florida resident Alec Pilavian, alleging negligence, breach of implied contract, breach of the covenant of good faith and fair dealing, and unjust enrichment, seeking to represent a nationwide class with estimated damages exceeding $5 million
- Lawsuit #2: A second, separate suit was filed in the same court by plaintiff Frank Rugnetta, centering on the nine-month gap between the November 2025 breach and Suno’s July 2026 disclosure, during which affected users say they were never notified
- Relief sought: Beyond damages, plaintiffs are seeking a court order requiring Suno to strengthen its data security practices and provide affected users with at least ten years of credit monitoring
How to try it
- Suno has not issued individual user notifications, maintaining that “based on the limited nature of the customer information believed to be involved,” individual notices were not required under applicable privacy law
- Whether the lawsuits proceed, and whether Suno discloses further details, remains to be seen
- Check Suno’s official site (suno.com) and blog (suno.com/blog) for further updates