Recent reports indicate that Suno, an AI music generation platform, may have utilized unauthorized methods to collect data from various online sources, including YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds, to train its AI models. This information came to light following a security breach in November 2025, where a hacker allegedly accessed Suno’s internal systems through a supply chain attack, obtaining employee credentials and subsequently, the company’s source code.
The hacker’s findings suggest that Suno engaged in ‘stream ripping,’ a practice that involves downloading audio content directly from streaming platforms, which is generally considered illegal under the Digital Millennium Copyright Act (DMCA). This method circumvents protective measures implemented by platforms like YouTube to prevent unauthorized data extraction and violates their terms of service.
Suno has previously acknowledged using publicly available music files from the internet to train its AI, asserting that such practices fall under the fair use doctrine. However, major record labels have contested this claim, arguing that the deliberate circumvention of platform protections constitutes a breach of copyright law. These labels have initiated legal action against Suno, alleging that the company’s data collection methods infringe upon their intellectual property rights.
In addition to the legal challenges, the security breach reportedly exposed sensitive customer information, including email addresses, phone numbers, and partial credit card details stored in Stripe. Despite the severity of the incident, Suno did not inform its customers about the breach, describing it as a ‘limited security incident that was quickly contained.’
This situation underscores the ongoing tension between AI developers and content creators regarding data usage and copyright. As AI technologies continue to evolve, the industry must navigate the complex landscape of intellectual property rights, ensuring that innovation does not come at the expense of creators’ rights and privacy. The outcome of the legal proceedings against Suno could set a significant precedent for how AI companies source and utilize data in the future.
