Hack Exposes Suno AI's Training Data: Millions of Songs Scraped from YouTube, Deezer, and Genius

A hacker who breached AI music generation platform Suno in November 2025 has exposed source code revealing the company scraped millions of songs and lyrics from streaming platforms to train its models. The breach, first reported by 404 Media and confirmed by Suno to Gizmodo, provides an unusually detailed look inside the training data of a major AI music tool.

The leaked code includes scraping instructions and dataset inventories showing Suno collected 2,013,545 music clips from YouTube Music, 113,879 hours of audio from the same platform, 17,615 hours from lyrics site Genius, and 62,117 hours from royalty-free music site Pond5. Other sources included Deezer, Jamendo, Freesound, and podcast RSS feeds.

What the Hacked Source Code Reveals

The breach gave the hacker access to Suno's source code from 2023 and 2024, which contained detailed scraping scripts and training library metadata. The data shows Suno systematically pulled music files and lyrics from publicly accessible third-party websites, including major streaming services. A Suno spokesperson told Gizmodo the incident was quickly contained and involved outdated source code no longer in use. The company said no sensitive personal information was compromised, though the hacker reportedly accessed customer email addresses and Stripe payment details. Suno did not notify impacted customers individually, stating that individual notifications were not warranted under applicable privacy laws.

• 2,013,545 music clips scraped from YouTube Music
• 113,879 hours of audio from YouTube Music
• 17,615 hours of lyrics from Genius
• 62,117 hours from Pond5
• Additional data from Deezer, Jamendo, Freesound, and podcast RSS feeds

Legal and Industry Implications

Suno has been sued by major record labels including Universal Music Group, Capitol Records, Atlantic Records, Warner Music, and Sony Music. The labels allege Suno's model can reproduce copyrighted works, citing a prompt for "1954 rock and roll billy haley comets" that allegedly produced output mimicking Bill Haley's style and melody. Suno maintains its training falls under fair use, arguing in legal filings that its data includes "essentially all music files of reasonable quality that are accessible on the open internet." The company says it builds its models to help users create original music, not replicate existing artists, and has implemented filters to block prompts using specific artist, song, or album names. The hack provides concrete evidence of the scale of scraping that musicians and labels have long suspected. Suno's fair use defense remains untested in court, with only a few rulings on similar AI training cases producing split outcomes. The company appears to be betting that either its legal argument will prevail or that any eventual fine will be manageable.