AI music generator Suno suffered a security breach in November 2025 when a hacker accessed source code detailing the company's training data practices. The intruder compromised a Suno employee via a worm to obtain GitHub and cloud service credentials, exposing outdated source code and a customer list containing information on hundreds of thousands of users, including email addresses and phone numbers.

Data provided to 404 Media shows Suno scraped music and lyrics from YouTube Music, Deezer, and Genius, along with stock music libraries. The company allegedly used proxy services to harvest content from YouTube, including acapella versions, and RSS feeds to scrape hundreds of thousands of podcasts. Suno previously admitted in a 2024 court filing to scraping tens of millions of recordings, arguing fair use.

The startup faces a copyright infringement lawsuit from major record labels, though Warner Music Group exited the case after reaching a licensing agreement. Suno confirmed the breach but stated no sensitive personal information or full credit card numbers were compromised, and that individual notifications were not legally required.