Suno AI Music Generator Accused of Scraping YouTube in Data Breach

An alleged hacker has revealed evidence suggesting that the popular AI music generator Suno may have scraped decades of audio data from platforms like YouTube Music and Deezer to train its artificial intelligence models. The claims emerged following a supply chain attack in November 2025, according to a report by 404 Media. The hacker reportedly obtained employee credentials, granting access to source code that details Suno's data acquisition methods.

Suno has previously stated that its AI is trained on "publicly available music files" found across the internet, asserting that such use falls under the doctrine of fair use in copyright law. However, major record labels currently engaged in legal battles with Suno argue that circumventing YouTube's anti-scraping measures is illegal under the Digital Millennium Copyright Act (DMCA) and violates YouTube's terms of service. This practice of scraping copyrighted material for AI training has become a contentious issue across the tech industry, with competitors like Udio also facing similar accusations.

Customer Data Compromised in Breach

Beyond the alleged data scraping for AI training, the hacker also claims to have accessed sensitive customer information. This included customer emails, phone numbers, and partial credit card details processed through the payment platform Stripe. Suno, however, did not publicly disclose this breach to its users. The company described the incident as a "limited security incident that was quickly contained," suggesting they did not believe it warranted widespread notification. This stance has drawn scrutiny, particularly given the nature of the data reportedly compromised.

The implications of these allegations are significant, not only for Suno but for the broader landscape of AI development. The use of copyrighted material for training large-scale AI models without explicit permission is a complex legal and ethical challenge. Companies like Google, the parent company of YouTube, are also facing similar legal pressures from various publishers regarding the scraping of book data for AI training. The outcome of these ongoing disputes could set precedents for how AI models are developed and what data sources are deemed acceptable.

The incident raises questions about the security practices of AI companies and their transparency with users regarding data usage and breaches. As AI continues to evolve rapidly, the need for clear regulations and ethical guidelines governing data acquisition and intellectual property protection becomes increasingly critical. The music industry, in particular, is closely watching these developments, concerned about the potential impact on artists' rights and the value of their work in an AI-driven future.