Loading story…
AI music generator Suno was breached after a supply-chain compromise reportedly infected an employee with the Shai-Hulud worm, giving an attacker access to source code, customer records, and Stripe-related payment data. Reports said the exposed customer information included email addresses, phone numbers, and partial credit card details, while Suno described the November 2025 incident as limited and quickly contained. The company also reportedly did not notify affected customers, and said the leaked code was largely outdated and that full card numbers are not stored in Stripe.
Leaked source code allegedly showed Suno collected training audio and metadata from a wide range of services, including YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, IMSLP, stock music libraries, and podcast feeds indexed through PodcastIndex. The breach was tied to the broader Shai-Hulud campaign, a worm that steals GitHub and cloud credentials from developer environments and can expose them through public GitHub repositories after spreading via malicious package republication across ecosystems such as npm, PyPI, and Packagist.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Data from the Suno breach was reportedly added to Have I Been Pwned, indicating that more than 55 million user accounts were exposed. The dataset reportedly consisted mainly of email addresses, some phone numbers, and tens of thousands of Stripe-related records with partial payment details.
Suno acknowledged that it experienced a security incident in November 2025 and said the event was limited and quickly contained. The company stated that the exposed code was primarily outdated and that full credit card numbers are not stored in Stripe.
Analysis of the leaked source code reportedly showed that Suno scraped training data from services including YouTube Music, Deezer, Genius, stock music libraries, and podcast feeds. One report also listed sources such as Pond5, Jamendo, Freesound, IMSLP, and PodcastIndex-linked podcasts.
According to reporting on the incident, an attacker used a supply-chain attack involving the Shai-Hulud worm to obtain an employee's credentials and gain unauthorized access to Suno source code and customer data. The exposed data reportedly included email addresses, phone numbers, and partial Stripe-related payment card information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
12 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourceteiss.co.uk
Open sourcesecuritymagazine.com
Open sourcemalware.news
Open sourcecyberveille.ch
Open sourcesocket.dev
Open source404media.co
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SoundCloud confirmed unauthorized access to an internal/ancillary service dashboard that enabled attackers to correlate **hidden email addresses** with information already visible on public SoundCloud profiles, impacting roughly **29.8 million accounts** (about **20%** of its user base). Exposed data was primarily **email addresses** plus public-profile metadata (e.g., usernames/display names, avatars, follower/following counts, and other profile statistics); SoundCloud stated **no passwords or financial data** were accessed. Users also reported service disruptions around the time of the incident, including access issues such as `403 Forbidden` errors (notably when connecting via VPN), consistent with post-incident security changes and response actions. Reporting attributed the intrusion and subsequent extortion attempt to the **ShinyHunters** group, with SoundCloud later acknowledging the actor made demands and used harassment tactics such as **email flooding**. The stolen dataset was subsequently leaked and then added to *Have I Been Pwned* for exposure checking, increasing downstream risk of targeted phishing and account-takeover attempts via credential stuffing on other services where users may have reused emails as identifiers. Separate contemporaneous claims by ShinyHunters against other companies (e.g., Panera Bread, CarMax, Edmunds) were reported but are distinct from the confirmed SoundCloud incident and include different alleged access vectors (e.g., stolen SSO codes).
Jun 29, 2026
The **ShinyHunters** extortion group claimed responsibility for a recent **Okta SSO voice-phishing (vishing)** campaign used to steal authentication codes and access victim environments. The group told reporters and researchers it used vishing to obtain Okta single-sign-on codes to compromise **Crunchbase** and **Betterment**, and then published alleged stolen data after the organizations reportedly rejected extortion demands; ShinyHunters also said additional victims exist and that more disclosures are forthcoming. ShinyHunters published alleged datasets for **Crunchbase, Betterment, and SoundCloud** on a newly launched leak site, asserting the dumps contain **PII** and large record counts (reported as **>20 million** for Betterment, **~2 million** for Crunchbase, and **~30+ million** for SoundCloud). **SoundCloud** stated it is aware of data published online allegedly taken from its organization and said its security team, supported by third-party experts, is reviewing the claim and the posted data; ShinyHunters asserted SoundCloud access was *not* obtained via SoundCloud’s Okta credentials. SoundCloud had previously confirmed a breach affecting roughly **20% of users** (about **28 million** based on public user counts), while Crunchbase and Betterment had not publicly responded at the time of reporting.
Jun 29, 2026
A supply-chain malware campaign known as **Shai-Hulud** compromised hundreds of packages in the npm ecosystem and later spread into both npm and PyPI, using stolen maintainer credentials and trusted publishing workflows to push trojanized releases. Early reporting said the worm affected more than 500 npm packages, searched infected developer and CI/CD environments for GitHub Personal Access Tokens, cloud API keys, and other secrets, and exfiltrated them to attacker-controlled infrastructure and public GitHub repositories. GitHub removed hundreds of malicious packages, while CISA urged organizations to review dependencies, check for cached malicious packages, rotate credentials, and enforce phishing-resistant MFA for developer accounts. Later waves became more aggressive and broader in scope. Researchers said a second campaign hit hundreds more npm packages and had a blast radius exceeding **27,000 repositories**, abusing `preinstall` and other lifecycle hooks to steal secrets, hijack GitHub Actions, self-propagate into additional packages, and in some cases deploy a conditional wiper-like payload. A subsequent **Mini Shai-Hulud** wave affected more than 170 packages across npm and PyPI, including packages tied to TanStack, Mistral AI, OpenSearch, Guardrails AI, UiPath, and others; it used files such as `router_init.js`, invoked Bun through malicious package scripts, targeted npm, GitHub, cloud, Kubernetes, Vault, and CI/CD credentials, and demonstrated that provenance and OIDC-based trusted publishing can still be abused when attacker-controlled code runs inside legitimate release workflows.
Jun 30, 2026