Hacker Breaches AI Music Platform Suno, Exposes Source Code Detailing Training Data Sources

A hacker broke into AI music platform Suno, walking out with source code detailing where the company's training data came from. The breach, first reported by 404 Media, confirms music industry allegations of unauthorized use of copyrighted material. Suno lets users generate full songs from text descriptions, built on a substantial training dataset. The leaked material includes scraping instructions and logs from 2023-2024, showing specific sources: 113,879 hours from YouTube Music, 152,162 tagged YouTube tracks, 62,117 hours from Pond5, 12,287 from Deezer, and 17,615 hours labeled genius_hq (associated with Genius). Plans to download ~1 million hours of podcast audio via RSS feeds were also documented. One log counted 2,013,545 YouTube Music clips, totaling millions of recordings across decades. The hacker claims access to hundreds of thousands of customer records (emails, numbers, Stripe info), which Suno disputes, stating the breach was "limited" and involved outdated code. Suno identified the incident in November 2025 and deemed individual notifications unnecessary under privacy laws. Users learned of this through news. Suno's website, under California's AB 2013, acknowledged training data might include protected music, listing tens of millions of audio files. The hack adds specificity, corroborating the RIAA's 2025 allegation that Suno ripped songs from YouTube, contested under fair use. A parallel lawsuit against Udio was settled in November 2025. Suno's case with Sony and UMG remains active, with the company valued at $5.4 billion and 100 million users. The Atlantic previously published databases of AI training music, including 12 million and 9 million track listings. The breach highlights the scope of AI music training and potential copyright infringements.