AI music generator Suno is facing new scrutiny after a reported hack exposed internal material that appears to show how the company gathered training data, according to 404 Media. The hacker said they gained access through a supply chain attack that let them obtain an employee’s credentials, and from there they were able to view source code tied to Suno’s data collection methods.
That material allegedly indicates Suno scraped large amounts of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds over many years. Suno has already said that it trains its systems on publicly available music files found on the open internet, and it has argued that using copyrighted material can be covered by fair use. Record labels suing the company dispute that position and say intentionally bypassing YouTube’s anti-scraping protections would violate the Digital Millennium Copyright Act as well as YouTube’s terms.
Security and customer data concerns
The reported breach was not limited to training data. According to the report, the hacker also reached customer information stored in Stripe, including email addresses, phone numbers, and partial credit card numbers. Suno did not alert customers about the November 2025 incident and has described it as a limited security event that was quickly contained.
The allegations arrive as legal pressure on AI music platforms continues to build. Suno’s rival Udio has also been accused of scraping YouTube data, while Google, YouTube’s parent company, is facing similar copyright claims from major book publishers. The latest disclosures add another layer to the wider debate over how AI companies collect data, what sources they rely on, and where copyright law draws the line.
Source: techcrunch.com
