Data obtained from a hack of music AI developer Suno confirms that the company trained its models by mass-collecting millions of songs and lyrics from popular platforms, including YouTube Music, Deezer, and Genius. Since the startup has always avoided revealing its training sets, this leak was a rare opportunity to learn where Suno actually got its content from.
Data obtained from a hack of music AI developer Suno confirms that the company trained its models by mass-collecting millions of songs and lyrics from popular platforms, including YouTube Music, Deezer, and Genius. Since the startup has always avoided revealing its training sets, this leak was a rare opportunity to learn where Suno actually got its content from.
This was reported by 404 Media, which received documents and source code from a hacker under the nickname ellie.191.
The materials obtained contain Suno source code for 2023 and 2024, as well as detailed instructions for automated collection (scraping) of audio files from YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, and the International Music Library Project (IMSLP). In particular, one of the documents states that Suno has managed to process over 2 million clips from YouTube Music.
To circumvent the platform’s limitations, the startup enlisted the help of third-party data provider Bright Data. Using its tools, the company searched YouTube for mostly a cappella versions of songs to get clean vocals for training the AI. In addition, the developers tried to upload about 1 million hours of podcasts through the PodcastIndex service.
In a comment to reporters, Suno representatives did not actually deny using these sources.
«As we have previously stated in public documents and disclosures, Suno’s AI models were trained on publicly available music files and associated metadata available on third-party websites on the open internet,» a company spokesperson said.
In addition to technological secrets, the attackers gained access to Suno’s customer database. Hackers managed to steal email addresses, phone numbers, and payment details from the Stripe payment system. Despite the seriousness of the incident, users only learned about it now — the company decided not to send out notifications about the hack.
Suno claims that the incident occurred in November 2025 and the situation was quickly brought under control. According to the startup, the leak involved outdated code, Stripe payment information was not affected, and the scale of the breach allegedly did not require mandatory individual notification of users by law.
Recall that last year Warner Music Group announced an agreement with developers Suno. At that time, the companies settled a lawsuit alleging copyright infringement.
