Hacked data from Suno has given a rare look at the material behind the company’s AI music generator: millions of songs and lyrics collected from online services including YouTube Music, Deezer and Genius, according to 404 Media.
The report lands in the middle of a copyright fight Suno has not been eager to make less opaque. The company has faced multiple lawsuits alleging that it used copyrighted works to train its models. One of the prominent cases was brought by the Recording Industry Association of America, which has sued over alleged use of protected music in AI training.
404 Media’s report says the information came from data obtained in a hacking incident. The exposed data, as described by the outlet, points to scraping: automated collection from existing web services rather than a disclosed licensing pipeline or a public catalog Suno had previously named.
That distinction is central to the dispute around generative music systems. Training data is the raw material a model studies to learn patterns: melody, harmony, lyrics, structure, production style and the statistical relationships between them. If that material comes from copyrighted recordings and lyrics, the fight quickly becomes less about whether the model can produce catchy output and more about who supplied the ingredients, who got paid, and whether permission was required.
What the hacked data appears to show
According to 404 Media, the Suno data identified material pulled from YouTube Music, Deezer and Genius. YouTube Music and Deezer host audio catalogs, while Genius is known for lyrics. The report says the scale ran to millions of songs and lyrics.
Suno has not publicly laid out, in detail, what is in its training datasets or how the company obtained the material used to build its music generator. That gap has made outside evidence unusually important. The hacked data does not resolve the legal question by itself, but it offers a more concrete view of what plaintiffs and rightsholders have been arguing about.
The lawsuits against Suno allege the company trained on copyrighted material. The RIAA case is the most visible example named in the reporting. Suno’s position in those disputes is not fully described here, and the existence of scraped data is not the same thing as a court ruling on infringement or fair use.
Still, the mechanics matter. Scraping from YouTube Music, Deezer and Genius, if accurately described by 404 Media, would mean Suno’s system was built using material taken from platforms where music and lyrics are already distributed for human listening and reading. That is a different story from a company saying, in the abstract, that its model learned from music.
For musicians, labels, publishers and lyric sites, the report sharpens the practical question behind the litigation: whether AI music companies can ingest existing catalogs at scale and call the result model training, or whether that use requires permission and payment. Courts, not marketing pages, will decide the legal answer.
This story draws on original reporting from The Verge AI.