Suno Source Code Breach Details Scraping of Millions of Songs

LinkKris HoltNews

A hacker gained access to Suno's source code and internal data, revealing specific methods used by the AI music generator to scrape music, lyrics, and podcasts from services including YouTube Music, Deezer, and Genius. The leak also exposed customer contact details.

Key points

  1. The hacker compromised a Suno employee via a worm to obtain credentials for GitHub and cloud infrastructure.
  2. Leaked materials detail scraping of YouTube Music, Deezer, Genius, stock music libraries, and hundreds of thousands of podcast RSS feeds.
  3. Reports indicate proxy services were used to scrape audio from YouTube, including acapella tracks.
  4. The breach included customer lists containing email addresses and phone numbers for hundreds of thousands of Suno users.
  5. Suno confirmed a security incident from November 2025, claiming it involved outdated source code and that payment data on Stripe remained uncompromised.

Why it matters

The breach offers technical evidence on how generative AI audio platforms gathered vast datasets without explicit upfront licensing. It provides fresh context for ongoing copyright disputes while highlighting developer-credential compromises.

Analysis

While Suno previously acknowledged scraping tens of millions of recordings under a fair-use defence during US record label lawsuits, the leaked data documents the operational mechanics, including proxies and targeted platforms. Suno stated that the incident was contained in November 2025 and did not require user notifications under applicable privacy laws, asserting that no sensitive personal data was breached.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Article:Wikipedia Contributors

    Common Crawl: The Web Scraping Backbone of Modern AI Models

    The non-profit Common Crawl Foundation provides open web archives that have become the primary training data for large language models such as ChatGPT and Gemini. While widely used across the industry, the organisation faces intense scrutiny regarding paywalls, copyright, and crawler blocking.

    AI & LLMs· Resource

  • Repository:snyk-workshops/vulnerable-student-assistant

    Vulnerable Student Assistant: Workshop App Demonstrating Prompt Injection Risks

    A demonstration repository by Snyk Workshops featuring an intentionally vulnerable AI chat application built with FastAPI and the Gemini 2.5 Flash model. It is designed for testing and learning about prompt injection and sensitive data exposure.

    4starsPython

    AI & LLMs· Demo

  • Link:Snyk

    Snyk Launches AI Security Engineer Foundations & Certification

    Snyk has introduced a six-module training curriculum titled AI Security Engineer Foundations. Delivered online and in person, the half-hour sessions address security across agentic workflows, MCP architectures, and AI-assisted development.

    AI & LLMs· Resource

  • Video

    Video:CURT

    AI Security Engineer Foundations: Securing LLMs, Agents, and MCP Tools

    In this workshop, Snyk Developer Advocate Javier Garza breaks down foundational AI security practices. Walking through the OWASP Top 10 for LLMs, he demonstrates direct and indirect prompt injection attacks, sensitive data disclosure, and supply chain risks, while detailing defensive architectures including system prompts, human approvals, database views, and MCP security scans.

    AI & LLMs· Talk

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.