Source code taken in a hack of Suno names YouTube Music, Deezer and Genius among the places the AI music company collected audio from to build its models. The files were reported by 404 Media on July 15 and summarised by Music Business Worldwide. The hacker, who shared them with 404 Media, also obtained records on hundreds of thousands of Suno customers, including emails or phone numbers and Stripe payment details.
The code reportedly lists sources including Genius, YouTube Music, Freesound, Jamendo and Deezer, with a note that non-music would be filtered out. One YouTube Music log records just over two million clips taken in. The datasets described include about 114,000 hours tagged youtube_music and another 152,000 hours tagged ytm_tagged. There are also about 62,000 hours from the stock library Pond5, 19,500 from the International Music Score Library Project, 17,600 from Genius and 12,300 from Deezer: decades of audio in all.
Other code appears to search YouTube for a cappella versions, apparently to isolate vocals, and to route scraping through proxies from Bright Data. A separate job gathered about 420,000 podcasts and tried to download about a million hours of audio. 404 Media said it could not tell exactly how the non-YouTube sites were scraped. Pond5, owned by Shutterstock, says it holds 2.5 million tracks, and the data suggests Suno took a large share of them. Genius does not host songs itself, but lets Apple Music subscribers play tracks and previews on its site.
This matters for the RIAA-coordinated lawsuit by Universal and Sony, which already accuses Suno of stream-ripping from YouTube and getting around its encryption. That claim is separate from Suno's argument that the copying itself is fair use. Suno has told the court it trained on essentially all good-quality music on the open internet while respecting paywalls and passwords. Deezer and Pond5 both charge for access. The labels want up to $150,000 per work and $2,500 per act of circumvention. At the time, they had asked to expand the case from 560 works to 61,026.
A Suno spokesperson repeated that its models were trained on publicly available files. They said a November 2025 security incident was limited and involved outdated code and no sensitive personal data, and that Suno cannot see full card numbers in Stripe. Suno decided that individual breach notices were not required, though some affected users told 404 Media they had never been informed. Suno said it had filed the training-data disclosure that California law requires. It also said it builds its models around a principle it calls "Original Creation, By Design", does not use artist names as training labels, and believes artists deserve both new opportunities and strong protections. The hacker said they got in by infecting an employee's machine with the Shai-Hulud supply-chain worm, which steals GitHub and cloud logins, and that they simply like hacking anything.
Deezer, one of the named sources, presents itself as a leader in detecting AI music. It says its tool spots tracks from models such as Suno and Udio with 99.8% accuracy, that it was the first streaming service to tag AI music across its platform, and that it tagged more than 13.4 million AI tracks in 2025 while keeping fully AI-made music out of recommendations. Jamendo, also named, sued Suno on June 29 over a dataset licensed only for non-commercial research, seeking at least EUR 17.8 million. Warner left the label case after settling with Suno in November 2025. 404 Media had previously reported that Nvidia and Runway also scraped YouTube for training data, and its Nvidia story led to a 2025 class action.
Sources · 1