Suno AI breach exposes alleged YouTube scraping and customer data
A hack of the AI music generator’s systems has disclosed training data sources and exposed partial financial records, complicating ongoing legal battles with major record labels.
A security breach at Suno AI has exposed the company’s source code and customer data, revealing allegations that the AI music generator scraped audio from major platforms including YouTube Music, Deezer, and Genius. The incident, which occurred in November 2025, was reported by 404 Media after a hacker claimed to have accessed the firm’s internal systems using stolen employee credentials obtained through a supply chain attack.
According to the leaked code, Suno utilised proxy services to scrape music from YouTube, including acapella versions of tracks, and ingested hundreds of thousands of podcasts via RSS feeds. The data also reportedly included audio from stock music libraries. These findings provide concrete evidence of the data collection methods Suno employs, which the company has previously defended as training on publicly available files under the fair use doctrine.
The breach also compromised customer information, including email addresses, phone numbers, and partial credit card details held by payment processor Stripe. Suno confirmed the incident but stated that individual user notifications were not warranted under applicable privacy laws due to the limited nature of the compromised data. The company described the event as a limited security incident that was quickly contained.
The disclosure arrives as Suno faces intense legal scrutiny from major record labels. The labels are suing the company for copyright infringement and alleged violations of the Digital Millennium Copyright Act (DMCA), arguing that deliberately circumventing YouTube’s protections to scrape data is illegal. Suno’s previous legal stance has been that training on open internet content falls within fair use, a position currently being contested in court.
This incident highlights broader industry tensions regarding AI training data. Competitor Udio has also been accused of scraping YouTube data, and Google, YouTube’s parent company, faces similar copyright allegations from major book publishers. The breach underscores the regulatory and legal risks facing AI firms that rely on extensive data scraping to train their models.
