A 404 Media report says that the AI music generator Suno was breached after an attacker used a supply‑chain attack to obtain an employee’s credentials. The intruder told the publication they then accessed Suno’s source code, which allegedly revealed that the service scraped decades of audio from multiple sources.
Sources the attacker says were scraped
According to the hacker’s account, the accessed source code showed data collection from:
- YouTube Music
- Deezer
- Genius
- various stock music libraries
- podcast RSS feeds
The attacker claimed the scraping covered audio spanning multiple decades.
Legal and privacy disputes
Suno has previously acknowledged training its AI on “publicly available music files” found on the open internet and has argued that training on copyrighted material can fall under the fair use doctrine. Major record labels that are suing Suno counter that deliberately circumventing YouTube’s anti‑scraping protections is illegal under the Digital Millennium Copyright Act (DMCA) and also violates YouTube’s terms of service.
A competitor, Udio, has faced similar accusations of scraping YouTube data. Google, YouTube’s parent company, is also confronting comparable copyright infringement claims from several major book publishers.
Customer data access and Suno’s response
The 404 Media source says the attacker also accessed customer information, including customer email addresses, phone numbers, and partial credit card numbers stored in Stripe. Suno did not notify customers of the breach that reportedly occurred in November 2025 and describes the incident as a “limited security incident that was quickly contained.”
Why this matters
The report raises questions around the legality and ethics of training generative AI on scraped content, compliance with platform terms and copyright law, and the handling and disclosure of user data following security incidents. Ongoing litigation and further investigations will be central to determining whether Suno’s practices complied with legal requirements and industry expectations.
