Hack suggests AI music generator Suno scraped YouTube for training data

A hack into the AI music generator Suno has revealed that the platform may have trained its artificial intelligence using data scraped from YouTube and other music sources, according to a report by 404 Media. The breach, which occurred through a supply chain attack, allowed hackers to access an employee's credentials and subsequently gain entry to Suno’s internal systems. Among the findings were documents indicating that Suno had allegedly collected audio from YouTube Music, Deezer, Genius, stock music libraries, and podcast RSS feeds over several years. The breach exposed more than just the training methodology of Suno’s AI model. Hackers gained access to sensitive customer information, including email addresses, phone numbers, and partial credit card details stored in Stripe, the payment processing platform used by the company. These details could potentially be exploited for identity theft or financial fraud. Suno has yet to publicly disclose all the specifics of the breach, though it stated in a statement that the incident was "quickly contained." According to the hacking group, the stolen data includes source code that outlines how Suno’s AI was trained on “publicly available music files” found on the open internet. This aligns with previous statements made by Suno, which claimed that its use of such data falls under the fair use doctrine, a legal principle that allows limited use of copyrighted works without permission. However, major record labels have taken issue with this stance, asserting that Suno’s actions violate both the Digital Millennium Copyright Act (DMCA) and YouTube’s terms of service. Under the DMCA, it is illegal to intentionally bypass technological measures designed to prevent unauthorized access to copyrighted content. YouTube employs such measures to block data scraping, making Suno’s alleged activities a potential violation of federal law. Additionally, the use of YouTube’s content without proper authorization could expose the company to lawsuits from rights holders who claim their work was used without consent. This controversy is not unique to Suno. Competitor Udio has also faced accusations of scraping YouTube data, suggesting a broader pattern within the AI music generation space. Meanwhile, Google, as the parent company of YouTube, has been sued by multiple book publishers for alleged copyright infringement related to its handling of digital content. These cases highlight growing concerns about the ethical and legal boundaries of AI training practices in the entertainment industry. Suno has not issued a public apology for the breach nor has it confirmed whether the stolen data will be released. The company claims that the breach was limited in scope and that it took swift action to secure its systems. However, critics argue that the lack of transparency surrounding the incident raises serious questions about the company’s commitment to user privacy and data protection. As investigations continue, regulatory bodies and legal experts are likely to scrutinize Suno’s operations more closely. With the rise of AI-generated content, the lines between innovation and intellectual property infringement are becoming increasingly blurred. For now, the focus remains on understanding the extent of the breach and determining whether Suno’s practices comply with existing laws and ethical standards.