According to a report by 404 Media, the AI music generator Suno was compromised by hackers.

The hacker informed the publication that they employed a supply chain attack in November to obtain an employee’s credentials, which enabled access to source code that purportedly revealed how Suno scraped years’ worth of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds.

Suno has previously acknowledged that it trains its AI using “publicly available music files” found on the internet, contending that it is permitted to use copyrighted material under the fair use doctrine, a subjective exemption in copyright law. However, major record labels currently suing Suno argue that it is illegal under the Digital Millennium Copyright Act (DMCA) to intentionally bypass YouTube’s safeguards against data scraping; this action also breaches YouTube’s terms of service.

Udio, a rival of Suno, has also faced accusations of extracting data from YouTube. Google, the parent entity of YouTube, is encountering similar copyright infringement claims from several prominent book publishers.

The hacker allegedly gained access to customer information including emails, phone numbers, and partial credit card details stored in Stripe.

Suno did not inform customers about the breach that occurred in November 2025, asserting that it was a “limited security incident that was rapidly contained.”