Hackers Stole Data on 78 Million Users From AI Music App Suno and Gig Platform Paidwork
Two separate breaches exposed names, payment details, bank account numbers, and tens of millions of email addresses. Here is what happened and what affected users should do.
Key points
- Hackers stole data on 55.3 million Suno accounts, including partial payment card details, according to Have I Been Pwned's analysis published in June 2026.
- A separate breach at Paidwork, a platform where users complete small paid tasks online, exposed 23.3 million unique email addresses along with bank account numbers and financial transaction records.
- Suno's breach, which occurred in November 2025, also exposed tens of thousands of Stripe payment records containing names, physical addresses, and card expiry dates alongside the last four digits of card numbers.
- The Paidwork attackers leaked an 11 GB database in late May 2026, claiming it held roughly 22 million user records.
Two separate breaches hit Suno, an AI-powered music generator, and Paidwork, a site where people complete small digital jobs for money. The Suno intrusion dates to November 2025; the Paidwork targeting to March 2026. Neither company had publicly confirmed the breaches at the time of writing. SecurityWeek first reported the scale of both incidents.
Gig-worker fraud is already a documented problem: our 8 July story on fake DoorDash support calls showed how quickly criminals move once they have earnings-platform credentials.
What did the criminals actually take?
For Suno, Have I Been Pwned (HIBP), a free service that tells people whether their data has appeared in a known breach, identified 55.3 million unique email addresses. The haul also included phone numbers and tens of thousands of Stripe payment records, with names, home addresses, purchase amounts, card type, expiry date, and the last four digits of card numbers.
The Suno breach exposed something else: source code, the private instructions that make the software run. That code reportedly revealed Suno had been scraping, automatically copying content without permission, from Deezer, YouTube, and Genius.
The Paidwork breach is arguably worse for affected individuals. HIBP found 23.3 million unique email addresses, but attackers also took names, dates of birth, phone numbers, home addresses, password hashes (scrambled versions of passwords that can sometimes be cracked), bank account numbers, and financial transaction records.
Bank account numbers are a serious escalation. Combined with a name and address, that's enough for criminals to attempt fraudulent transfers or impersonation scams. Paidwork users who linked bank accounts to receive earnings carry the sharpest exposure here.
Should you worry?
Change your password on the affected platform now, and anywhere else you reused it. Paidwork users should review recent bank statements for unrecognised transactions and consider calling their bank to flag the risk. Treat any email or text claiming to be from Suno or Paidwork asking you to verify details as suspicious until the companies make an official statement.
The failure mode is a familiar one: sensitive payment data and bank details sitting in the same store as profile information, with no public sign users were told promptly. The post-mortem will note that financial records had no business living alongside email addresses and password hashes in a single database. That's not a hard architectural rule to enforce in S3 or RDS; it's just one that gets skipped until it isn't.
