Hacked supply code from AI music firm Suno lists YouTube Music, Deezer, and Genius among the many platforms it scraped to construct its AI fashions, based on a report from 404 Media on Wednesday (July 15).
The code was obtained by a hacker who breached Suno and shared it with the publication.
The identical hacker additionally accessed data on a whole bunch of hundreds of Suno prospects, together with emails and/or cellphone numbers, and Stripe fee particulars, based on the report.
The hacked knowledge corroborates the labels’ allegation that Suno ripped songs instantly from YouTube, based on the report.
Suno has already acknowledged in a court docket submitting that its coaching knowledge was drawn from music throughout the open web.
The corporate is defending itself in opposition to Common Music Group and Sony Music Leisure in a copyright infringement lawsuit coordinated by the RIAA, and argues that coaching on copyrighted works is protected as honest use.
In that submitting, Suno stated its coaching knowledge “contains primarily all music recordsdata of cheap high quality which can be accessible on the open web, abiding by paywalls, password protections, and the like.”
The hacked code names sources Suno drew on and logs the quantity of fabric it took, based on 404 Media.
Feedback in a single file stated the system would pull from “genius_hq, youtube_music, freesound, jamendo, imp, deezer, ytm_tagged,” and that “non-music will probably be filtered out,” based on 404 Media.
A file named “youtube_music” recorded that it had ingested “2,013,545 music clips,” the publication reported.
The datasets Suno constructed included 113,879 hours of fabric logged as youtube_music, plus an extra 152,162 hours logged as ytm_tagged, based on the report.
Additionally they included 62,117 hours from the inventory library Pond5, 19,514 hours from the Worldwide Music Rating Library Undertaking, 17,615 hours from Genius, and 12,287 hours from Deezer, the report stated.
In whole, the fabric ran to not less than a long time of audio, based on 404 Media.
Different code confirmed Suno trying to find a capella variations of songs on YouTube, in what 404 Media stated seemed to be an effort to isolate vocals.
The code additionally indicated that Suno used proxies from an organization referred to as Vivid Knowledge to scrape songs from YouTube, based on the report.
The code additionally confirmed Suno utilizing a service referred to as PodcastIndex to drag collectively some 420,000 podcasts, every with a minimal of 5 half-hour episodes, and trying to obtain about 1,000,000 hours of audio.
404 Media stated it was unclear from the recordsdata precisely how Suno scraped materials from the opposite platforms.
Pond5, a inventory library owned by Shutterstock, says it holds 2.5 million music tracks, and Suno‘s knowledge instructed it took a considerable portion of the library, based on the report.
Genius doesn’t host songs instantly however lets Apple Music subscribers play tracks and samples by way of its web site.
The YouTube scraping is already a part of the report trade’s lawsuit in opposition to Suno.
In an amended criticism filed in September 2025, the RIAA accused Suno of “stream ripping” recordings from YouTube and circumventing the platform’s “rolling cipher” encryption, which is designed to dam unauthorized downloading.
“Suno obtained these copies within the first occasion by unlawfully ‘stream ripping’ them from the favored streaming platform YouTube, and circumventing the technological measures designed particularly to stop such unauthorized copying,” the RIAA wrote in its lawsuit.
404 Media stated the hacked knowledge confirmed the RIAA‘s declare that Suno took songs from YouTube.
The labels argue that circumventing these measures breaches the anti-circumvention provisions of the Copyright Act.
That declare sits other than Suno‘s fair-use protection, which applies to the copying itself quite than to any bypassing of entry controls.
The labels are searching for statutory damages of as much as USD $150,000 per work infringed, plus as much as $2,500 for every act of circumvention.
In Might, UMG and Sony requested the court docket to broaden the case from 560 works to 61,026 that they recognized in Suno’s coaching knowledge by way of audio fingerprinting – a leap that may carry the theoretical most in statutory damages from round $84 million to greater than $9 billion. The decide has but to rule.
In a press release to 404 Media, a Suno spokesperson stated: “As we now have acknowledged in public filings and disclosures, Suno’s AI fashions have been skilled on publicly obtainable music recordsdata and associated metadata accessible on third-party web sites on the open Web.”
The spokesperson stated Suno decided in November 2025 that it had been “the topic of a restricted safety incident that was rapidly contained.”
“As we now have acknowledged in public filings and disclosures, Suno’s AI fashions have been skilled on publicly obtainable music recordsdata and associated metadata accessible on third-party web sites on the open Web.”
suno spokesperson (through 404 Media)
“We instantly carried out an investigation and verified that the incident primarily concerned outdated supply code that’s not in use at Suno and that no delicate private data was compromised,” the spokesperson stated.
“Importantly, Suno doesn’t have entry to prospects’ full bank card numbers in Stripe,” they added.
The spokesperson stated Suno had concluded that particular person breach notifications “weren’t warranted below relevant privateness legal guidelines,” and that the corporate had filed a training-data disclosure required below California legislation.
The hacker, who makes use of the identify ellie.191[,] informed 404 Media they bought in by hitting a Suno worker with Shai-Hulud, a supply-chain worm that scoops up GitHub and cloud-service logins.
Among the prospects whose data had been uncovered confirmed to 404 Media that that they had not been notified of a breach.
The hacker stated that they had no particular motivation, telling 404 Media: “I wish to hack something and all the things.”
Deezer, one of many platforms named within the code, is a subscription service that has positioned itself as a distinguished participant within the identification of AI-generated music.
The corporate says its instrument identifies tracks from fashions similar to Suno and Udio with 99.8% accuracy, and that it was the primary streaming service to tag AI music on the platform degree.
Deezer says it tagged greater than 13.4 million AI tracks throughout 2025 and eliminated absolutely AI-generated music from its suggestions.
Suno‘s court docket submitting stated its coaching knowledge was gathered “abiding by paywalls, password protections, and the like.”
Each Deezer and Pond5, named within the hacked code, require fee for entry.
Jamendo, the Luxembourg-based licensing platform named within the code, is individually suing Suno. It filed a copyright infringement declare on June 29 in the identical Massachusetts court docket, alleging Suno skilled on a roughly 55,600-track dataset, licensed for non-commercial tutorial use solely, with out paying for a business licence.
Jamendo is searching for not less than €17.8 million ($20 million).
Warner Music Group, a former co-plaintiff, exited the case after settling with Suno in November 2025 and coming into a licensing partnership that included Suno‘s acquisition of Songkick.
Suno raised greater than $400 million in funding in June.
404 Media has beforehand reported that Nvidia and Runway ML additionally scraped YouTube to collect coaching knowledge. The Nvidia article led to a class motion lawsuit in opposition to the corporate in 2025.
In the meantime, the Suno spokesperson stated the corporate builds its fashions round what it calls “Unique Creation, By Design,” and doesn’t use artist names as a class of coaching metadata.
“We imagine artists deserve each new alternatives and robust protections,” the Suno spokesperson stated.
Mikey Shulman, Suno‘s CEO and founder, stated on a podcast final yr that he believes the “majority of individuals don’t get pleasure from nearly all of the time they spend making music.”Music Enterprise Worldwide
