Suno's data breach in 2025 exposed over 113,000 hours of music data and sensitive user information, raising legal and ethical concerns.
Overview of the Breach
Suno, an AI music generation platform, suffered a significant data breach in 2025, where a hacker utilized the Shai-Hulud worm to extract source code and access sensitive user information.
Details of the Data Compromised
The breach revealed that over 113,000 hours of music data was scraped from YouTube Music, alongside 62,000 hours from Pond5 and 12,000 hours from Deezer, among others. In total, the hacker claimed to have accessed data belonging to hundreds of thousands of users, including their emails, phone numbers, and payment information via Stripe.
Suno acknowledged in prior compliance disclosures that its training dataset may include music that is protected by intellectual property rights, aligning with ongoing legal disputes in the music industry.
Implications for Suno and the Music Industry
The leaked source code has drawn attention to the legal challenges Suno faces, particularly from the Recording Industry Association of America (RIAA), which previously accused the company of infringing on copyrights by using music from YouTube without permission. The RIAA is seeking damages of $150,000 for each alleged infringement. This breach adds weight to the RIAA's claims, demonstrating the extent of Suno's music data collection.
Suno detected the breach in November 2025 and characterized it as limited, asserting that the exposed data primarily consisted of outdated source code. As a result, they deemed individual customer notifications unnecessary under privacy laws, a stance criticized by some as users only learned of the breach through external reports.
Context and Future Outlook
This incident comes amid broader scrutiny of AI music generation practices. Recent databases cataloging music used to train AI models have emerged, revealing the scale of music integration into AI systems. The legal landscape for AI music companies continues to evolve, with Suno currently embroiled in litigation with major labels, while its valuation stands at $5.4 billion with approximately 100 million users on its platform.
