Suno data breach lawsuits merge into one class action covering 55 million users

The two class actions over Suno’s data breach are now one case. A federal judge in Massachusetts has consolidated the pair of lawsuits covering the November 2025 breach, which is said to have compromised the sensitive data of 55 million users, as Digital Music News reported on August 28.

The order sets a clock. The plaintiffs have 30 days to file a fresh consolidated complaint, and Suno then gets 45 days to respond.

What the consolidation order changes for Suno users

Consolidation means one complaint, one defense, one judge, instead of two suits fighting over the same facts. The court put Lynch Carpenter partner Gerald D. Wells III and Milberg’s Casondra Turner in place as interim co-lead class counsel. Milberg bills itself as “a pioneer in federal class action litigation.”

The underlying claims stay the ones I covered when the suits were filed: negligence and breach of implied contract, built on the allegation that users were “wholly unaware of the Data Breach for nine months” until Have I Been Pwned findings hit the news on July 20, 2026. The plaintiffs describe “a significantly increased and certainly impending risk of fraud” and point to a post-breach spike in spam and phishing.

One detail from the second complaint could matter more than it looks: Suno’s welcome email allegedly didn’t “display, summarize, or hyperlink any arbitration provision.” If that holds, it gets harder for Suno to push these claims out of court and into private arbitration.

If you had a Suno account before November 2025, nothing is required from you yet. Class certification comes later. Rotate your password, watch the card you had on file, and sit tight. The exposed data included names, addresses, and partial payment card details.

Suno’s courtroom pile keeps growing

Suno, meanwhile, is hiring lead security engineers at all three of its offices. That tells you the company knows which complaint hurt.

The breach case runs alongside the copyright front, where Universal and Sony just filed an amended complaint adding stream ripping claims, and Round Hill and a class of independent musicians have their own suits pending. The company that leaked source code showed scraping YouTube Music, Deezer, and Genius is now litigating on both fronts at once: how it took data in, and how it let data out.