Leaked Data Suggests Suno May Have Used YouTube Content to Train Its AI Music Model

AI music generation startup Suno has reportedly suffered a security breach, according to a report published by 404 Media.

The individual behind the hack told the publication that they carried out a supply chain attack in November, gaining access to an employee’s credentials. That access allegedly exposed internal source code suggesting Suno collected decades of audio content from platforms including YouTube Music, Deezer, Genius, podcast RSS feeds, and stock music libraries to train its AI models.

Suno has previously acknowledged that its AI systems are trained using “publicly available music files” found across the internet, maintaining that such use is protected under the fair use doctrine of U.S. copyright law. However, the major record labels currently suing the company argue that deliberately bypassing YouTube’s protections against automated data scraping violates the Digital Millennium Copyright Act (DMCA) as well as YouTube’s terms of service.

Suno is not the only AI music company facing such allegations. Rival Udio has also been accused of scraping YouTube content for AI training purposes. Meanwhile, Google, which owns YouTube, continues to face multiple copyright lawsuits from major book publishers over claims that copyrighted material was used to train its AI systems. According to the report, the attacker also gained access to customer information, including email addresses, phone numbers, and partial credit card details stored through Stripe.

Suno did not notify customers about the November 2025 security breach. The company has described the incident as a “limited security incident that was quickly contained.”