Suno — an app that vomits out soulless audio within the type of AI-generated “music” — has been hacked. In accordance with 404 Media, the hacker accessed information associated to Suno’s coaching practices, in addition to particulars on its prospects.
It isn’t precisely a secret at this level that copyrighted music has been used for AI coaching. Final month, The Atlantic dug into datasets containing tens of millions of songs which are used for such functions.
Nonetheless, this hack sheds some extra gentle on Suno’s information vacuuming practices. Information the hacker supplied to 404 Media indicated that Suno scraped music and lyrics from the likes of YouTube Music, Deezer and Genius, in addition to inventory music libraries. The corporate could have used proxy providers to scrape music from YouTube, together with acapella variations of songs, per the report. It seems Suno used RSS feeds to scrape a whole bunch of 1000’s of podcasts too.
Suno has confronted a copyright infringement lawsuit from file labels within the US. Late final yr, Warner Music Group dropped out of the case because it reached a licensing take care of Suno. Again in 2024, Suno admitted in a court docket submitting that its programs scraped “tens of tens of millions of recordings” from the web to make use of as coaching information, arguing that its method constituted “honest use beneath copyright regulation.”
To acquire the info, the hacker mentioned they hit a Suno worker with a worm that allowed them to entry credentials for GitHub and cloud providers. Together with the small print about Suno’s music-scraping practices, they reportedly obtained its buyer listing. That is mentioned to have info relating to a whole bunch of 1000’s of Suno prospects, together with e-mail addresses and telephone numbers.
Suno confirmed the hack in an announcement to 404 Media. A spokesperson, who additionally famous that the corporate has programs that attempt to stop customers from replicating artist’s present music, mentioned:
As now we have said in public filings and disclosures, Suno’s AI fashions have been skilled on publicly out there music recordsdata and associated metadata accessible on third-party web sites on the open Web. In November of 2025, we decided that Suno had been the topic of a restricted safety incident that was rapidly contained. On the time, we instantly carried out an investigation and verified that the incident primarily concerned outdated supply code that’s not in use at Suno and that no delicate private info was compromised. Importantly, Suno doesn’t have entry to prospects’ full bank card numbers in Stripe.
Primarily based on the restricted nature of the shopper info believed to be concerned, we decided that particular person notifications weren’t warranted beneath relevant privateness legal guidelines.
