Suno Hack Reveals YouTube Scraping for AI Music Training Data

A hacker breached AI music startup Suno in November 2025 using a supply chain attack, stealing source code that reveals the company allegedly scraped decades of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds. The breach, first reported by 404 Media, also compromised customer data including email addresses, phone numbers, and partial credit card numbers stored in Stripe. The hacker claims Suno's code deliberately stripped YouTube's technical protections, an action that directly contradicts the platform's terms of service and the Digital Millennium Copyright Act (DMCA). Suno had previously argued it can train on copyrighted material under fair use, but major record labels (Universal Music Group, Sony Music, Warner Music) are actively suing the company for copyright infringement.

The timing is particularly damaging: the hack exposes not just a security failure but potentially incriminating evidence in an ongoing legal battle. Suno did not notify affected customers about the breach and described it as a "limited security incident that was quickly contained." However, the stolen data—including partial credit card numbers—creates significant privacy risks for users. Rival platform Udio faces similar scraping allegations, and Google (YouTube's parent) is itself being sued by book publishers for analogous copyright violations. The case underscores music AI's fundamental tension: startups need massive training data to compete, but the legal gray area around scraping copyrighted content leaves them exposed to both litigation and security vulnerabilities.