AI music generation platform Suno is facing a proposed class action lawsuit in the United States over a November 2025 data breach that allegedly exposed the personal information of 55.3 million users.
Lawsuit Details
The complaint, filed on 24 July in the US District Court for the District of Massachusetts, claims the company failed to adequately safeguard customer data and did not inform affected individuals about the incident. Florida resident and Suno customer Alec Pilavian is named as the lead plaintiff, seeking to represent a nationwide class of users whose information was compromised.
According to the legal filing, the breach exposed names, physical and email addresses, phone numbers, purchase histories, and partial payment card details including expiry dates. The lawsuit contends that Suno “prioritised profits over data security” and that customers “have been left to speculate as to where their [information] ended up, who has used it, and for what potentially nefarious purposes.”
Suno’s Response
Suno confirmed it experienced a security incident in November 2025 and said it is reviewing the complaint. A company spokesperson stated:
Trust is the foundation of any product people use every day, and we take safeguarding our community’s data security extremely seriously. In November of 2025, we experienced a security incident that was quickly contained.
The spokesperson added that a subsequent investigation found the incident “primarily involved outdated source code and a limited amount of information associated with certain users.” Suno does not store full payment card information or collect bank account details, the company said, and it hired a third-party cybersecurity expert to audit its initial findings.
We know any security incident can be alarming. As Suno continues to grow, we are continuing to invest in our security programme and the team behind it.
Legal Claims and Relief Sought
The proposed class action asserts claims of negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment, and declaratory judgment. It seeks damages exceeding $5 million, along with a court order requiring Suno to strengthen its data security practices and provide affected users with at least 10 years of credit monitoring services.
