Hack reveals Suno accessed source code showing alleged scraping of YouTube and other audio sources

A hacker gained access to Suno’s internal systems using an employee’s credentials, according to a report from 404 Media. The hacker then accessed source code that allegedly shows Suno scraped decades of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds.

Suno has previously stated that it trains its AI on 'publicly available music files' on the open internet, arguing that it can train on copyrighted material under the fair use doctrine—a subjective interpretation of copyright law. However, major record labels suing Suno contend that the company’s alleged scraping violates the Digital Millennium Copyright Act (DMCA) by deliberately circumventing YouTube’s protections against data scraping. YouTube’s terms of service also prohibit such scraping.

The hacker also accessed customer data, including customer emails, phone numbers, and partial credit card numbers stored in Stripe. Despite the breach occurring in November 2025, Suno did not notify customers and described the incident as a 'limited security incident that was quickly contained.'

The allegations against Suno mirror similar accusations faced by Udio, a competitor AI music generator, which has also been accused of scraping YouTube data. Google, YouTube’s parent company, is also facing copyright infringement allegations from major book publishers over similar data scraping practices.