AI music startup Suno is facing escalating legal and ethical scrutiny after a hack appeared to expose how its hit-generating models were built on massive, covert scraping of songs and lyrics from major music platforms. The revelations sharpen a high-stakes fight over whether training AI on copyrighted music is lawful fair use or industrial-scale copyright theft.

November 2025: Hack exposes Suno’s internal systems

In November 2025, a hacker used a supply chain attack to obtain an employee’s credentials and access Suno’s internal systems and source code.¹ The intruder later shared files with outlet 404 Media, claiming they showed how Suno “scraped decades of audio” from YouTube Music, Deezer, Genius, stock music libraries, and even podcast RSS feeds.²

The leaked materials reportedly included scraping instructions and Suno code from 2023–2024, describing how to pull audio from YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, and the International Music Score Library Project.¹ One file allegedly showed Suno had consumed over 2 million YouTube Music clips and even searched specifically for a cappella tracks to isolate vocals.¹

Lawsuits and the fair use defense

Even before the hack, Suno had been sued by major record labels, including a high-profile case led by the Recording Industry Association of America (RIAA). The labels allege Suno “unlawfully circumvented YouTube’s copyright protections” by intentionally stream-ripping tracks and violating YouTube’s terms of service.¹²

Suno has acknowledged training on “publicly available music files” from the open internet and argues that using copyrighted material in training is permitted under the U.S. fair use doctrine, a subjective and still-untested carve-out in this context.¹²

Broader industry and user backlash

The hack has intensified concerns that Suno “snatched millions of songs from YouTube, Genius, and Deezer” without permission,¹ drawing parallels to similar allegations against rival AI music generator Udio and to lawsuits accusing Google of scraping copyrighted books for AI models.²

Beyond copyright, the breach reportedly exposed customer emails, phone numbers, and partial credit card numbers stored in Stripe.² Suno has characterized this as a “limited security incident that was quickly contained” and did not notify users, a decision that could invite regulatory scrutiny alongside its mounting legal battles over AI training data.