The Second Lawsuit Against Suno Is About 60,000 Songs Nobody Licensed

What happened

When Universal Music Group and Sony Music Entertainment filed their second lawsuit against Suno, the filing was not a formality. It named the company's latest generative model, v6, as trained on more than 60,000 copyrighted recordings the labels had never agreed to license. The scale of the allegation, and the fact that this was a follow-up action rather than an opening salvo, tells you something about how the first round went.

The core claim is one the music industry has been building toward for years. Suno's models generate original-sounding music by learning patterns from existing recordings. If those recordings were copied without authorization, then every track the model produces carries the residue of that unlicensed training. Universal and Sony are arguing that this is not an edge case or a gray area: they tracked the specific works involved, counted them, and put a number on the record. Sixty thousand songs is not an oversight in a data pipeline. It is a scale that suggests a deliberate decision to move fast and negotiate later, or not at all.

The fact that this is a second lawsuit matters. It means an earlier dispute over Suno's practices did not resolve the underlying conduct. Suno released v6 after the first suit was filed, and Universal and Sony are alleging that the new model continued relying on unlicensed material. From the labels' position, that reads as a company that absorbed the first lawsuit as a cost of doing business rather than a signal to change course.

Separately, Suno is facing class action lawsuits tied to a data breach that exposed personal information belonging to millions of users. The combination of an intellectual property dispute with a data protection failure puts the company in an unusual position: defending both what it took to train its systems and what it failed to protect once users trusted it with their own data. Neither incident is minor, and they are running in parallel.

What both threads share is a gap in verifiable record-keeping. For the training data dispute, the central question is what Suno's models were trained on and when those decisions were made. For the breach, it is what data was held, how long, and what safeguards existed. In both cases, the absence of a provable record of what the system did and who authorized each step is precisely what makes litigation the only available mechanism for establishing the truth. If that record existed and was auditable from the start, the dispute over training data would not require courts to reconstruct it.

Reported impact

Affected parties

Not publicly disclosed

Harm type

Not publicly disclosed

Scale

Not publicly disclosed

Financial impact

Not publicly disclosed

Regulatory action

Not publicly disclosed

Classification

Organization

Not publicly disclosed

AI system

Not publicly disclosed

Industry

Not publicly disclosed

Country

Not publicly disclosed

Provider

Not publicly disclosed

Incident type

Not publicly disclosed

Relevant governance controls

Governance control mapping is not available for this record.

• No controls mappedNot publicly disclosed

Control mapping is analytical. It does not state that any control would have prevented the incident.

Sources and evidence

This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.