Key Takeaways
Suno Hack Exposes 2 Million Scraped YouTube Songs
- A hacker accessed Suno's source code allegedly showing scraping of YouTube Music, Deezer, and podcast feeds for training data
- Customer data including emails, phone numbers, and partial credit card numbers was exposed in the November 2025 breach
- The hack adds fuel to ongoing lawsuits from major record labels claiming Suno violates copyright law
A hacker claims to have accessed Suno's internal systems and found source code showing the AI music generator scraped decades of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds. The breach, first reported by 404 Media, also exposed customer data that Suno never disclosed to users.
The hacker told 404 Media they used a supply chain attack in November 2025 to obtain an employee's credentials. From there, they accessed source code and customer records including emails, phone numbers, and partial credit card numbers stored in Stripe. Suno calls this a "limited security incident that was quickly contained" but did not notify affected users about the breach.
What does the leaked code allegedly show?
According to the hacker's claims, Suno's training pipeline pulled audio from multiple sources: YouTube Music, the streaming service Deezer, lyrics database Genius, stock music libraries, and podcast RSS feeds. If true, this contradicts Suno's public position. The company has admitted training on "publicly available music files" but has maintained its approach qualifies as fair use under copyright law.
The distinction matters legally. Scraping YouTube likely violates the Digital Millennium Copyright Act, which prohibits circumventing technical protections against data collection. It also breaks YouTube's terms of service. Major record labels Sony, Universal, and Warner are already suing Suno on these exact grounds.
Why didn't Suno disclose the breach?
Suno has not explained why it kept quiet about the November 2025 incident. Customer notification laws vary by state, but most require disclosure when personal financial data is compromised. Partial credit card numbers stored in Stripe fall into that category for many jurisdictions.
The company's statement calling this "quickly contained" raises questions. A supply chain attack that yielded source code and customer payment data is not a minor incident. Security researchers will want to know which vendor was compromised and whether Suno's partners have been notified.
The broader fight over AI training data
Suno's legal exposure is substantial. The company raised $125 million in Series B funding in May 2024 at roughly a $500 million valuation. It claims over 12 million users. But the record labels' lawsuit seeks $150,000 per infringed work. If the labels can prove Suno trained on thousands of copyrighted songs, damages could dwarf the company's entire valuation.
Udio, Suno's main competitor, faces similar accusations. Google itself has been sued by major book publishers over training data for its AI models. The hack does not prove Suno's practices are illegal, but it provides potential evidence that plaintiffs will certainly request in discovery.
The RIAA has been blunt about the stakes. Chairman Mitch Glazier has argued that "fair use was never intended to allow wholesale copying of creative works to build commercial products." Courts will ultimately decide, but the hacked code, if authenticated, could shift the legal calculus significantly.
What this means for AI companies
The Suno hack is a warning. Any AI company scraping copyrighted content faces two risks: legal action from rights holders, and the possibility that internal practices get exposed through a breach. Documenting your training data sources honestly matters. Lying about them creates liability that extends beyond copyright into fraud territory.
For enterprises evaluating AI music tools, this incident raises due diligence questions. If you integrate a service that was trained on scraped content, are you exposed to secondary liability? The answer depends on your use case, but the question now has to be asked.
Logicity's Take
The Suno hack is less about the data breach itself and more about what was found inside. AI companies have operated under a tacit assumption that training data practices would stay internal. That assumption is now proven false. Competitors like Udio face similar scrutiny, but so does every generative AI firm that has not clearly documented its data sources. For tech leaders evaluating AI vendors, the new question is simple: can your vendor prove its training data is licensed or public domain? If not, you're inheriting their legal risk.
Frequently Asked Questions
Did Suno scrape YouTube to train its AI music model?
A hacker claims to have found source code showing Suno scraped YouTube Music, Deezer, and other sources. Suno has not confirmed this but has admitted training on 'publicly available music files.'
What customer data was exposed in the Suno breach?
The hacker reportedly accessed customer emails, phone numbers, and partial credit card numbers stored in Stripe. Suno did not notify affected customers.
Is scraping YouTube for AI training illegal?
Circumventing YouTube's anti-scraping protections likely violates the Digital Millennium Copyright Act and YouTube's terms of service. Courts have not yet ruled definitively on this in the context of AI training.
What lawsuits does Suno face?
Sony, Universal, and Warner sued Suno in June 2024 for copyright infringement, seeking up to $150,000 per infringed work. The case is ongoing.
How much funding has Suno raised?
Suno raised $125 million in Series B funding in May 2024, valuing the company at approximately $500 million.
Another example of AI intersecting with security vulnerabilities in enterprise tech
Need Help Implementing This?
If you're evaluating AI tools for your organization and need help assessing vendor risk, data governance, or compliance frameworks, contact Logicity's advisory team for a consultation.
Source: TechCrunch / Amanda Silberling
Manaal Khan
Tech & Innovation Writer
Produced with AI assistance and reviewed by the Logicity editorial team. Learn more in our Editorial Policy.
