Suno AI source code hack exposes scraping and customer data breach
A November 2025 supply chain attack on Suno exposed source code showing the AI music generator scraped millions of songs from YouTube Music, Deezer, Genius, and other platforms to train its models. The breach also revealed unauthorized access to customer data including emails, phone numbers and payment information.
What happened
In November 2025, a hacker using the moniker ellie.191 conducted a supply chain attack against Suno and obtained source code revealing the company's data scraping practices. The exposed code showed instructions to scrape millions of songs and metadata from YouTube Music, Deezer, Genius, Freesound, Jamendo, and the International Music Score Library Project.
Files accessed during the breach showed over 2 million music clips from YouTube Music, over 17,000 hours from Genius HQ, more than 12,000 hours from Deezer, and more than 62,000 hours from Pond5, a Shutterstock-owned stock music library. The hacker also accessed Suno's customer list containing emails, phone numbers, and Stripe payment details.
Reported impact
Deezer stated it has always been on the side of artists and that training data for generative AI should be obtained with clear approval and fair compensation, adding that any infringement should be sanctioned. The company said it was assessing the situation and considering available options.
A Suno spokesperson claimed the hack was quickly contained after discovery in November 2025, that the exposed code was outdated and no longer in use, and that no sensitive user information was compromised since the company does not retain full credit card numbers.
Index analysis
The hack provides evidence for ongoing copyright infringement lawsuits against Suno brought by record labels including Universal Music Group, Sony Music Entertainment and Warner Music Group, validating their allegations that Suno used artists' songs without consent or proper licensing.
Governance controls
Suno stated in public filings that its AI models have been trained on publicly available music files accessible on third-party websites on the open internet. The company concluded that under current privacy laws it did not need to notify individual users of the breach.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.