Suno, an AI music generator, was breached via a supply chain attack that exposed source code allegedly showing the platform scraped decades of audio from YouTube Music, Deezer, Genius, and other sources to train its model.
This contradicts Suno's public stance that it trains on 'publicly available' music under fair use; record labels suing the company say the scraping violates copyright law and YouTube's terms of service.
The hack also exposed customer emails, phone numbers, and partial credit card data.
What happened
The AI music generator Suno was hacked via a supply chain attack that exposed source code showing the platform allegedly scraped decades of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds to train its model. The hacker also obtained customer data including emails, phone numbers, and partial credit card numbers. Suno says the November 2025 breach was a 'limited security incident that was quickly contained' and did not notify customers at the time.
Why it matters
Suno has claimed it trains on 'publicly available music files' under fair use doctrine, but major record labels suing the company argue the scraping violates the Digital Millennium Copyright Act (DMCA) and YouTube's terms of service. The leaked source code may strengthen copyright infringement claims against Suno and expose the gap between the company's public defense and its actual training practices. Competitor Udio faces the same YouTube scraping allegations.
What to watch
The hack occurred in November 2025 but was not disclosed to customers at the time. The leaked source code details could significantly impact Suno's ongoing legal battles with record labels over copyright infringement.
Ask the AI about this article →
Suno's public defense rests on the claim that it trains on 'publicly available music files' and that such use falls under the fair use doctrine. However, the hacked source code appears to document a more deliberate and systematic approach to data acquisition from specific platforms — YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds — that contradicts the company's characterization. Record labels suing Suno have argued that circumventing YouTube's scraping protections violates the Digital Millennium Copyright Act; the leaked code may provide direct evidence of that circumvention. The breach also places Suno in the broader context of copyright disputes facing AI companies. Competitor Udio has faced identical YouTube scraping accusations, and even Google (YouTube's parent) faces copyright claims from book publishers over alleged scraping of copyrighted text. This pattern suggests that the tension between AI training practices and copyright protection is not unique to music but represents a systemic challenge across the industry.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
Mitsubishi Electric and its U.S
EDM producer Max "H4RRIS" Harris and Italian turntablist-turned-producer Nihil Young are publicly calling out…
Beatport now bans tracks made entirely or mostly by AI
The Fire and Disaster Management Agency plans to launch a model project in fiscal 2027 to use AI in handling 1…
AWS announced an integration where Amazon Quick, an agentic AI workspace, connects to fal's generative media p…
Leafnet and BBIX began collaborating in August 2026 to build a new service that combines voice and AI
