A November 2025 breach of Suno exposed source code detailing the AI music company's use of millions of songs scraped from YouTube Music and other platforms. The hacker shared files with 404 Media showing over 2 million clips from YouTube Music alone along with thousands of hours from Deezer, Genius and Pond5. Suno confirmed the incident but said it involved outdated code and no sensitive data.
The breach occurred when a hacker known as ellie.191 used a supply chain attack to access Suno's GitHub and cloud credentials. Files from 2023 and 2024 showed Suno scraped music and lyrics from YouTube Music, Deezer, Genius and stock libraries including Pond5. The data also included customer records from payment processor Stripe.
Suno stated in a response that the incident was contained quickly and involved only outdated source code no longer in use. The company added that no sensitive personal information was compromised and that it does not store full credit card numbers.
Suno has faced ongoing copyright lawsuits from major record labels over its training practices. The company maintains that its use of publicly available music constitutes fair use under copyright law. Warner Music Group previously settled its claims with a licensing agreement.