[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDAfQqF--uIMq_RPdoBVaOdqd-rBOIAOL2jamXaOu6R4":3},{"article":4,"iocs":47,"watch_terms":55,"solutions":56,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"ad25a2b6-640e-47da-a5ab-c3fb7bf462f1","Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts","suno-paidwork-data-breaches-affect-tens-of-millions-of-accounts-ebcd2d","Hackers leaked names, email addresses, phone numbers, passwords, and financial information stolen from the two platforms. The post Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts appeared first on SecurityWeek.","Two major platforms—AI music generator Suno and gig-work platform Paidwork—suffered significant data breaches affecting tens of millions of users. Suno was compromised in November 2025 with 55.3 million email addresses, phone numbers, and partial payment card information leaked; Paidwork was targeted in March 2026 with 23.3 million user records including bank account numbers and financial transactions exposed. The breaches were analyzed and reported by Have I Been Pwned (HIBP).","Hackers breach Suno and Paidwork, exposing 55.3M and 23.3M accounts with financial data.","https:\u002F\u002Fwww.securityweek.com\u002Fsuno-paidwork-data-breaches-affect-tens-of-millions-of-accounts\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F10\u002Fbank-finance-lender-credit-union-hack.jpeg","2026-07-22T15:02:11+00:00","2026-07-22T16:00:16.269519+00:00",9,[17,20,22,24,26],{"name":18,"type":19},"Suno","product",{"name":21,"type":19},"Paidwork",{"name":23,"type":19},"Have I Been Pwned (HIBP)",{"name":25,"type":19},"Stripe",{"name":27,"type":28},"music streaming platforms (YouTube, Deezer, Genius)","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":29,"icon":31,"name":32,"slug":33},null,"Breaches","breaches",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52],{"type":49,"value":50,"context":51},"malware","Suno breach","November 2025 intrusion; 55.3M email addresses, phone numbers, and Stripe payment records stolen",{"type":49,"value":53,"context":54},"Paidwork breach","March 2026 intrusion; 23.3M email addresses, passwords, bank account numbers, and financial transaction data leaked",[18,21,23],{"controls":57,"vendors":145},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"slug":88,"name":89,"problem":90,"products":91},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"slug":117,"name":118,"problem":119,"products":120},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":163},"suno-paidwork-breaches-expose-millions-of-financial-records","Suno & Paidwork Breaches Expose Millions of Financial Records","Two platforms—AI music service Suno and gig-work platform Paidwork—collectively exposed over 78 million user records, including highly sensitive financial data such as partial payment card numbers and bank account details. The exposure of financial information alongside personally identifiable data significantly elevates the risk of identity theft and fraud for affected users. These incidents highlight a persistent failure to adequately protect sensitive financial data at rest, enforce least-privilege access controls on user databases, and detect unauthorized access in a timely manner. The fact that breaches in late 2025 and early 2026 were surfaced through Have I Been Pwned rather than proactive internal detection suggests critical gaps in both monitoring and incident response capabilities.",[151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 SC-28 – Protection of Information at Rest","NIST SP 800-53 IR-6 – Incident Reporting","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 33 – Notification of a Personal Data Breach","PCI DSS Requirement 3 – Protect Stored Account Data","PCI DSS Requirement 10 – Log and Monitor All Access to System Components",{}]