Suno Hacked: Breach Exposes How AI Music Tool May Have Scraped Millions of Songs

Key points

• A hacker breached Suno, an AI music generator that lets users create songs from text prompts, in November 2025.
• The attacker used a supply chain attack, compromising a third-party vendor to steal an employee's login credentials and reach Suno's systems.
• Source code exposed in the breach reportedly shows Suno scraped audio from YouTube Music, Deezer, podcast RSS feeds, and stock music libraries.
• Customer data exposed includes email addresses, phone numbers, and partial credit card numbers held by payment processor Stripe.
• Suno did not tell customers about the breach and describes it as a "limited security incident that was quickly contained."

A hacker broke into Suno's systems and walked away with more than stolen data. They also found what could become key evidence in one of the music industry's biggest legal fights.

Suno is an AI music generator that lets anyone type a description and receive a finished song in seconds. The hacker told 404 Media, which first reported the story, that they gained access through a supply chain attack: rather than hitting Suno directly, they compromised a connected vendor, used that foothold to steal an employee's credentials, and got inside.

What they found matters. The exposed source code reportedly shows Suno pulling audio from YouTube Music, Deezer, Genius, podcast RSS feeds, and stock music libraries. That detail lands squarely in active litigation. Major record labels are already suing Suno, arguing that scraping audio from YouTube violates the Digital Millennium Copyright Act, a US law prohibiting deliberate circumvention of a platform's technical protections, and breaks YouTube's own terms of service.

Suno has previously said it trains on "publicly available music files" and argues this falls under fair use, a legal principle allowing limited use of copyrighted material without permission in certain circumstances. Courts haven't agreed or disagreed yet. The source code, if verified, could sharpen the labels' case considerably.

Competitor Udio faces similar scraping allegations. Google, which owns YouTube, is itself dealing with copyright claims from book publishers over AI training practices. The question of who gets to train on what, and whose permission matters, sits at the centre of a policy fight that Australia's Prime Minister has now entered directly, pledging on 15 July 2026 that musicians and writers will keep control of their work and get paid when AI companies use it.

For Suno's customers, the breach has a direct personal dimension. The hacker accessed email addresses, phone numbers, and partial card numbers stored through Stripe, the payment platform Suno uses for subscriptions. Partial card numbers aren't enough for fraudulent purchases on their own, but paired with email addresses they can fuel convincing phishing emails designed to trick you into handing over more.

Suno confirmed a breach occurred but called it a "limited security incident that was quickly contained." The company didn't notify customers.

Should Suno customers be worried?

Yes, though the immediate financial risk is narrow. Your full card number wasn't exposed, but your email and phone number were. Watch for messages appearing to come from Suno, Stripe, or your bank asking you to verify payment details or log in urgently. Legitimate companies don't ask for passwords or full card numbers by email. If you reuse your Suno password elsewhere, change it now and enable two-factor authentication, an extra login step that sends a code to your phone, wherever your accounts allow it.