AI Music Generator Suno Under Scrutiny After Data Scraping Allegations

TL;DR

• **Security Breach Confirmed:** A hacker exploited an employee's credentials to access Suno’s internal source code, revealing that the company scraped millions of songs and lyrics from YouTube, Deezer, and Genius for AI training.
• **RIAA Allegations Verified:** The leaked data corroborates the Recording Industry Association of America’s lawsuit claims that Suno illegally "stream-ripped" copyrighted recordings by bypassing YouTube’s encryption protections.
• **Legal & Ethical Fallout:** The breach intensifies scrutiny on Suno’s data practices, with major labels seeking up to $150,000 in damages per infringed work and penalties for circumventing technological measures.

AI Music Generator Suno Under Scrutiny After Data Scraping Allegations

A major security incident at AI music startup Suno has exposed the company’s internal training libraries, confirming allegations that it scraped decades of copyrighted audio from platforms like YouTube to build its generative models. The breach, which involved the exploitation of an employee’s credentials, allowed an attacker to access source code and user data, sparking a new wave of ethical and legal questions regarding data usage in artificial intelligence.

The Hack That Exposed the Training Data

The incident began when a hacker breached Suno’s systems by using compromised employee credentials, gaining access to the company’s source code and internal databases. According to reports from 404 Media, the attacker shared data revealing that Suno’s training libraries included millions of songs and lyrics sourced from YouTube Music, Deezer, and Genius.

The hacker also accessed user information for hundreds of thousands of customers and viewed Stripe payment details, though Suno later stated that full credit card numbers were not compromised. While the company described the incident as "limited" and noted that it primarily involved outdated source code no longer in use, the leaked data provided undeniable evidence of the scope of Suno’s data collection.

"Stream Ripping" and YouTube’s Encryption

The leaked files have directly validated the Recording Industry Association of America’s (RIAA) lawsuit against Suno, which accuses the company of illegally "stream ripping" music from YouTube. The amended complaint, filed in September 2025, alleges that Suno used code to bypass YouTube’s "rolling cipher" encryption to download and duplicate copyrighted materials without permission.

This method, known as stream ripping, converts streaming content into downloadable formats, effectively pirating the music. The RIAA contends that Suno’s evasion of these security measures enabled "continuous and widespread infringement" of the Digital Millennium Copyright Act (DMCA). The hacked data seen by 404 Media confirms that Suno indeed acquired many, if not all, of the copyrighted sound recordings in its training data through this illicit method.

Legal Battles and Massive Damages

The security breach has intensified the legal pressure on Suno, which is already facing a landmark copyright infringement case filed by major record labels including Universal Music Group, Sony Music Entertainment, and Warner Music Group. The original lawsuit, filed in June 2024, claimed Suno copied "decades worth of the world’s most popular sound recordings" without permission.

In the amended complaint, the labels are now seeking statutory damages of up to $150,000 for each infringed work, plus penalties of up to $2,500 for each act of circumventing technological protection measures. The evidence of stream ripping, shared by the International Confederation of Music Publishers (ICMP) in September 2025, has become a central pillar of the plaintiffs’ argument that Suno’s model was trained on unauthorized copies.

Suno’s Response and Industry Implications

In response to the breach, a Suno spokesperson stated that the company immediately conducted an investigation and verified that the incident involved outdated source code. The company emphasized that no sensitive personal information was compromised and that it does not have access to customers’ full credit card numbers. Suno also maintained that its models were trained on "publicly available music files" accessible on the open internet.

However, the RIAA disputes this defense, arguing that bypassing paywalls and encryption to access copyrighted content does not constitute "publicly available" usage. The incident has drawn broader attention to the ethical implications of AI training data, with over 200 artists mobilizing through the Artist Rights Alliance to advocate against AI infringement on human rights. As the legal proceedings continue in federal courts in Boston and New York, the Suno breach serves as a stark reminder of the vulnerabilities and ethical risks inherent in the rapid development of AI music technologies.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.