Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts

Two large-scale breaches exposed a combined ~78 million user records: Suno was compromised in Nov 2025 via the Shai-Hulud npm supply-chain worm that harvested developer credentials and leaked 55.3M email addresses, phone numbers, Stripe payment records, and private source code; Paidwork’s March 2026 breach exposed a 23M-record database containing full names, home addresses, phone numbers, bank account numbers, transaction histories, and other PII. The report details the worm’s propagation and credential-harvesting TTPs, timelines of disclosure and public postings, user mitigation steps, and regulatory/legal implications of delayed notification.