Breaches Expose Tens of Millions of Suno and Paidwork Users

Hackers exfiltrated source code and user data from AI music service Suno and published a large database alleged to be from gig-work platform Paidwork, exposing tens of millions of user records. Have I Been Pwned (HIBP) analyzed the materials and provided counts of exposed email addresses and other fields.

HIBP identified 55.3 million unique email addresses in the Suno dataset. The stolen Suno materials include phone numbers and tens of thousands of Stripe payment records that contain names, physical addresses, purchase amounts and partial payment card details such as card type, expiration date and the last four digits. The intrusion into Suno systems occurred in November 2025, and the attackers posted the company’s source code, which showed the service had been scraping audio and lyric content from several major platforms.

Hackers claimed to have breached Paidwork in March 2026 and released an 11 GB database in mid-2026. HIBP’s review of that dump found 23.3 million unique email addresses. The Paidwork dataset reportedly contains names, password hashes, physical addresses, dates of birth, phone numbers, bank account numbers, records of financial transactions and user profile information.

HIBP performed the analyses that produced the email counts and inventories of exposed fields for both incidents. HIBP found no full primary account numbers in the Stripe records it reviewed; only partial card metadata and last four digits were present. HIBP’s reporting does not indicate whether Suno or Paidwork have notified affected users.

Representatives for Suno and Paidwork were contacted for comment. Suno provides an AI-driven service that generates music and audio from user prompts. Paidwork operates a platform where people complete small paid tasks and manage payments and profiles. HIBP is a breach notification service that collects and analyzes leaked data so people can check whether their accounts appear in known incidents.