A hacker has breached the AI music platform Suno, according to a report from 404 Media. The attacker told the outlet they used a supply chain attack to steal an employee's login credentials, which then gave them access to source code revealing how Suno allegedly collected decades of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds.

Suno has previously acknowledged that it trains its AI on "publicly available music files" from the open internet, claiming it can use copyrighted material under the fair use doctrine—a subjective exception in copyright law. However, major record labels currently suing Suno argue this practice violates the Digital Millennium Copyright Act (DMCA), as it deliberately bypasses YouTube's anti-scraping protections and breaches YouTube's terms of service. A similar accusation has been made against Suno's competitor, Udio, for scraping YouTube data. Google, YouTube's parent company, also faces copyright infringement allegations from several major book publishers.

The hacker reportedly accessed customer data, including email addresses, phone numbers, and partial credit card numbers stored in Stripe. Suno did not notify customers about the November 2025 breach, describing it as a "limited security incident that was quickly contained."

EMBED_PLACEHOLDER_0