A third breach lawsuit hits Suno, filed 10 days after the first two were merged

Suno had two lawsuits over its November 2025 breach. A judge merged them into one on August 24. Ten days later, a man in Huron, South Dakota filed a third, as Music Business Worldwide reported. Michael Beckham’s complaint landed on September 3, 2026 in Massachusetts, where Suno is based.

How Michael Beckham found out he was in the dataset

He did not hear it from Suno. He says he opened an account with his Gmail address no later than the summer of 2024, and that Have I Been Pwned, a free service that tells you when your email turns up in a leak, flagged that address as part of the Suno data.

That gap is the whole complaint. Beckham says Suno has still not given him a disclosure naming which of his own fields were taken.

“The absence of timely, complete, and individualized information impaired Plaintiff’s ability to take targeted protective action,” the filing says.

He puts his own cost at roughly 10 hours spent dealing with it, plus a rise in spam calls and phishing attempts since. The complaint argues that time itself counts: “Plaintiff’s mitigation time is a present injury.”

What the complaint says was in the stolen Suno data

Citing Have I Been Pwned, the filing describes roughly 55.3 million unique email addresses, phone numbers where a phone was used to sign up, and “tens of thousands of Stripe purchase records” holding names, physical addresses, purchase amounts, card type, expiration date and the last four digits of payment cards.

Suno has said it does not store full card numbers or collect bank details.

The complaint also takes a swing at the company’s own wording. Suno’s privacy notice says it uses “commercially reasonable security measures and safeguards,” and Beckham’s lawyers argue the breach and the delay in disclosing it “plausibly show that the measures in place at the relevant time were not reasonable or were not reasonably implemented.”

What Beckham wants Suno to do

The case is a proposed class action, meaning one lawsuit brought for everyone in the same position rather than one person at a time. It asks for a nationwide group covering anyone in the US whose details were in the dataset, plus a separate South Dakota group, and puts the total at more than $5 million.

The asks go past money. Beckham wants a complete individual notice of what was taken, identity-theft, phishing and account-protection services for “not less than five years”, and changes to how Suno secures, keeps and deletes data from here.

His lawyers also moved early to block a likely defence, saying Beckham does not accept that Suno gave clear notice of any agreement to settle disputes privately instead of in court.

How this sits alongside the two cases already merged

The August order made Pilavian the lead case and gave those plaintiffs 30 days to file a single combined complaint, with Suno getting 45 days to answer after that.

Beckham’s filing says his case is related to Pilavian and that he expects it to be coordinated or folded in. The court has not ordered that yet.

Suno’s position, given when the first suit arrived in July, is that the incident “primarily involved outdated source code and a limited amount of information associated with certain users.” The company also decided at the time that individual breach notices “were not warranted under applicable privacy laws,” which is exactly the decision Beckham is now attacking.

None of this touches the copyright fight. Suno is separately defending claims from Universal and Sony in the same court, and it raised over $400 million in June at a $5.4 billion valuation.

If you have ever made a track on Suno, the useful move takes 30 seconds: put your sign-up email into Have I Been Pwned and see whether it comes back. Beckham had to do that himself, because nobody sent him a letter.