A breach at Suno exposed internal code and data that show the AI music company scraped songs, lyrics and audio from YouTube Music, Deezer, Genius and several stock or public audio libraries, according to 404 Media, which reviewed material supplied by the hacker.
The report gives a more concrete view of how Suno assembled training material for a system that can generate finished songs from prompts. That process is already central to record industry lawsuits against Suno, which accuse the company of using copyrighted music at scale without permission. Suno has argued in court that training on copyrighted works is protected fair use.
404 Media said the hacked files included source code from 2023 and 2024 with scraping instructions and dataset notes. One code comment listed sources including Genius, YouTube Music, Freesound, Jamendo, the International Music Score Library Project, Deezer and a tagged YouTube Music set, with a note that non-music would be filtered out.
One file named for YouTube Music said it had ingested 2,013,545 music clips, according to 404 Media. Other dataset comments cited 113,879 hours from YouTube Music, 17,615 hours from Genius, 410 hours from Freesound, 19,514 hours from IMSLP, 3,726 hours from Jamendo, 62,117 hours from Pond5, 12,287 hours from Deezer, 152,162 hours from a tagged YouTube Music dataset and 103 hours from Musescore lyrics.
The files also showed code that searched YouTube for acapella versions of songs, apparently to isolate vocals, 404 Media reported. Other code indicated Suno used proxies through Bright Data, a company that sells scraping infrastructure and data services, to pull songs from YouTube. The material also showed Suno using PodcastIndex to identify 420,000 podcasts with at least five 30-minute episodes and attempting to download roughly 1 million hours of podcasts.
Some parts remain unclear. 404 Media said the files did not fully show how Suno obtained material from each platform. Pond5, owned by Shutterstock, sells access to stock music and sound effects; Pond5 says its catalog contains 2.5 million music tracks. Genius does not host full songs directly, though it can play music or samples through Apple Music integrations.
Suno has already described its training set in litigation in broad terms. In a court filing cited by 404 Media, the company said its models were trained on publicly available music files and related text from the open internet, while respecting paywalls and password protections. The company said the training set included tens of millions of recordings.
The Recording Industry Association of America has alleged in its lawsuit that Suno copied large numbers of popular recordings and used stream-ripping from YouTube to obtain them while bypassing anti-copying measures. 404 Media said the breached material supports the YouTube-ripping allegation.
Suno said in a statement to 404 Media that it had disclosed its use of publicly available music files and related metadata from third-party websites. The company said it detected a limited security incident in November 2025, contained it quickly, and found that the incident mostly involved outdated source code no longer used by Suno. Suno said no sensitive personal information was compromised and that it does not have access to customers’ full credit card numbers in Stripe.
The hacker, who used the handle ellie.191, told 404 Media they got in by compromising an employee through the Shai-Hulud worm, a supply-chain attack that harvested GitHub and cloud credentials. The hacker said they accessed customer emails or phone numbers and Stripe payment details depending on how users logged in. 404 Media said some customers in a sample confirmed they had used phone numbers to sign up and said they had not been notified of a breach.
Suno told 404 Media that, based on the customer information it believed was involved, individual notifications were not required under privacy laws. The company also said it has safeguards meant to stop users from generating songs that copy existing artists and that it does not use artist names as a training metadata category.
This story draws on original reporting from 404 Media.
