AI music generator Suno was hacked, according to a report from 404 Media.

The hacker told the publication that they used a supply chain attack in November to access an employee’s credentials, allowing them to access source code showing how Suno allegedly scraped decades of audio from YouTube Music, Deezer, Genius, archive music libraries and podcast RSS feeds.

Suno previously admitted that it trains its AI on “publicly available music files” on the open Internet, arguing that it can train on copyrighted material under the fair use doctrine, a subjective exclusion of copyright law. But according to major labels actively suing Suno, it is illegal under the Digital Millennium Copyright Act (DMCA) to deliberately circumvent YouTube’s protections against data theft; It also violates YouTube’s terms of service.

Suno competitor Udio has also been accused of mining data from YouTube. Google, YouTube’s parent company, faces similar allegations of copyright infringement from a variety of major book publishers.

The hacker reportedly accessed customer data, including customer emails, phone numbers, and partial credit card numbers on Stripe.

Suno did not notify customers about the November 2025 breach and says it was a “limited security incident that was quickly contained.”