Hack suggests AI music generator Suno scraped YouTube for training data

A recent report by 404 Media has unveiled that the AI music generator Suno experienced a security breach, raising serious questions about its data sourcing methods. The hacker responsible for the breach disclosed that they executed a supply chain attack to gain access to an employee's credentials. This breach subsequently allowed them to uncover source code indicating that Suno allegedly harvested a vast array of audio from platforms including YouTube Music, Deezer, Genius, various stock music libraries, and podcast RSS feeds. Suno has acknowledged that its AI is trained on what it describes as 'publicly available music files' found on the internet. The company argues that this practice falls under the fair use doctrine, which provides a somewhat subjective exception to copyright law. However, major record labels that are currently suing Suno contend that it is unlawful under the Digital Millennium Copyright Act (DMCA) to intentionally bypass YouTube's protections against data scraping, a practice that also contravenes YouTube’s terms of service. In a related context, Udio, a competitor of Suno, has faced similar accusations regarding the scraping of YouTube data. Additionally, Google, the parent company of YouTube, is embroiled in allegations of copyright infringement from several prominent book publishers. The hacker’s intrusion reportedly led to the compromise of sensitive customer information, including emails, phone numbers, and partial credit card numbers from Stripe. Despite the gravity of the incident, Suno has not alerted its customers about the breach, describing it instead as a 'limited security incident that was quickly contained.'