• 2 min read
Suno breach exposed code tied to music scraping
A hacker reportedly accessed Suno source code and customer data, including evidence the company scraped songs, lyrics and podcasts for training.
Image: Engadget
A November 2025 breach at Suno exposed source code and internal data that reportedly describe how the music generation company scraped millions of songs and other audio from the open internet for training.
According to 404 Media, the hacker accessed information about Suno’s training practices along with customer-related data. Materials shared with the outlet indicate Suno scraped music and lyrics from YouTube Music, Deezer, Genius, and stock music libraries. The report also says Suno may have used proxy services to pull music from YouTube, including acapella versions of songs, and used RSS feeds to scrape hundreds of thousands of podcasts.
The hacker told 404 Media they targeted a Suno employee with a worm, which gave them access to credentials for GitHub and cloud services. They reportedly also obtained a customer list containing information on hundreds of thousands of Suno customers, including email addresses and phone numbers.
Suno confirmed the incident in a statement to 404 Media, saying it discovered the breach in November 2025 and contained it quickly. The company said the exposed material was “primarily outdated source code” that is no longer in use and that “no sensitive personal information was compromised.”
“As we have stated in public filings and disclosures, Suno’s AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet,” a Suno spokesperson said.
The spokesperson added that Suno does not have access to customers' full credit card numbers in Stripe, and said the company concluded that individual notifications were not required under applicable privacy laws.
Recommended reading
Hinge founder Justin McLeod readies Overtone AI matchmaker
The breach adds to scrutiny already facing Suno. In 2024, the company said in a court filing that it scraped “tens of millions of recordings” from the internet as training data, arguing that the practice qualifies as fair use under copyright law. Suno is also facing a copyright infringement lawsuit from US record labels, though Warner Music Group exited the case late last year after reaching a licensing deal with the company.
Computing Editor
Tomas lives in the terminal. He covers chips, laptops, and operating systems with a focus on performance and efficiency. He reads kernel changelogs the way other people read fiction, and he's always on the hunt for the perfect mechanical keyboard switch. If it processes data, Tomas has an opinion on it.
via Engadget
