According to a report from 404 Media, an AI music generator named Suno was hacked via a supply chain attack that gave the attacker access to an employee’s credentials.

The hacker claims to have viewed source code showing that Suno scraped decades of audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds for training data.

Suno had previously stated it trains its AI on publicly available music files and argued fair use over copyrighted material.

However, record labels suing Suno argue that bypassing YouTube’s anti-scraping measures violates the DMCA and YouTube’s terms of service.

The hacker also accessed customer data such as emails, phone numbers, and partial credit card numbers in Stripe.

Suno did not notify customers about the November 2025 breach, describing it as a limited and quickly contained security incident.