Suno AI confirms security breach exposing source code and customer data
The company stated that no sensitive financial information was compromised, though the breach highlights ongoing copyright disputes regarding its training data practices.
Suno AI has confirmed a security incident that occurred in November 2025, wherein a hacker accessed internal source code and customer data. The breach exposed documentation detailing how the company scraped millions of songs from platforms including YouTube Music, Deezer, and Genius, as well as stock music libraries. The incident also compromised email addresses and phone numbers for hundreds of thousands of users, intensifying scrutiny of the AI music platform’s data practices.
According to reports from 404 Media, the hacker gained access by deploying a worm against a Suno employee to obtain credentials for GitHub and cloud services. The leaked source code revealed that the company utilised proxy services to scrape music from YouTube, including acapella versions of tracks, and employed RSS feeds to ingest hundreds of thousands of podcasts. Suno stated that the incident primarily involved outdated source code that is no longer in use.
The company clarified that no sensitive personal information was compromised, noting specifically that it does not hold access to customers' full credit card numbers via payment processor Stripe. A Suno spokesperson indicated that individual notifications to users were not warranted under applicable privacy laws due to the limited nature of the customer information involved. The spokesperson also highlighted that the company has systems designed to prevent users from replicating existing artists' music.
This security breach occurs against a backdrop of significant legal pressure regarding Suno’s training data. The company has faced copyright infringement lawsuits from record labels in the United States. In 2024, Suno admitted in court filings that its systems scraped tens of millions of recordings from the internet, arguing that this constituted fair use under copyright law.
Warner Music Group withdrew from its lawsuit against Suno late last year after reaching a licensing deal with the company. Despite this development, the broader industry continues to face scrutiny over the use of copyrighted music for AI training, with recent reports detailing datasets containing millions of songs used by various platforms.
