Suno faces two class action lawsuits over the breach that exposed 55.3 million users
Suno is being sued twice over the data breach it never told its users about. Two proposed class actions have now been filed over the November 2025 incident that exposed personal data tied to 55.3 million accounts, with one lodged on July 24, 2026 in the US District Court for the District of Massachusetts.
What the Suno class actions allege
The complaints go after how Suno stored the data rather than the fact it was taken. One alleges Suno held user records in a “negligent and/or reckless manner”, and that the “mechanism of the cyberattack and potential for improper disclosure” of user data “was a known risk” to the company.
That framing puts Suno “on notice” before the attack happened, which is the pivot a negligence claim turns on. Complete Music Update reported both filings on July 29.
Users are now at a significantly increased and certainly impending risk of fraud, identity theft, intrusion of their privacy, and similar forms of criminal mischief, risk which may last for the rest of their lives.
The suits also claim affected users will have to “devote substantially more time, money and energy to protect themselves” from those risks.
The data taken in the November 2025 Suno breach
Have I Been Pwned lists names, addresses, email addresses, phone numbers, purchase histories and partial payment card details among the stolen records. Suno confirmed the incident only after media coverage forced a statement, having never posted a notification of its own.
That is a wider data set than an email-and-password leak. Home addresses and partial card numbers are the fields that make a breach index useful to someone building a fraud attempt.
Nine months passed before Suno users found out
The breach happened in November 2025 and surfaced in July 2026 through 404 Media reporting. One complaint states users “were wholly unaware of the data breach for nine months until public news sources disclosed the breach”.
Suno has acknowledged a cybersecurity incident occurred. It has still not run a formal notification process, and the lawsuits name that gap directly.
What Suno users should do now
Rotate the password and turn on two-factor authentication if you have not. Then check the card on file, because partial card data was in the set and the account details predate any warning you could have acted on.
If you are in the proposed class, nothing is required yet. Both suits are at the filing stage and neither has been certified.
These claims sit alongside a much larger legal pile. Suno is defending the RIAA copyright case and has already settled with Warner Music, and its CEO has apologised over training data.
Frequently asked questions
Where were the Suno data breach class actions filed?
One of the two proposed class actions was filed on July 24, 2026 in the US District Court for the District of Massachusetts, where Suno is based. Complete Music Update reported the second was filed within days of the first.
What do the Suno data breach lawsuits allege?
The complaints allege Suno stored user data in a negligent or reckless manner and that the mechanism of the cyberattack was a known risk the company was already on notice about. They also cite Suno's failure to notify affected users.
What kinds of personal data did the Suno breach expose?
According to Have I Been Pwned, the stolen data included names, addresses, email addresses, phone numbers, purchase histories and partial payment card details. The complaints argue this leaves users facing a lasting risk of fraud and identity theft.
Are the Suno data breach lawsuits connected to the RIAA copyright case?
No. These are separate consumer data-protection claims about how Suno stored and disclosed user information. They run alongside the copyright infringement cases brought by the RIAA and GEMA, which concern how Suno trained its models.
About the author
Covering AI music tools, industry shifts, and news for music creators and professionals. Twice-weekly newsletter at aimusicpreneur.com.
