A hacking incident has reportedly revealed that artificial intelligence (AI) music company Suno trained its models using millions of songs and lyrics scraped from online platforms, including YouTube Music, Deezer and Genius.
According to a recent report by 404 Media, files obtained from a hacker expose source code, internal documentation and scraping instructions dating from 2023 and 2024. The leaked materials allegedly show that Suno collected audio and lyrics from a range of online services, including YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound and the International Music Score Library Project (IMSLP).
The revelations come as Suno faces multiple copyright lawsuits over its AI training practices. In a high-profile case brought by the Recording Industry Association of America (RIAA), the company acknowledged that it trained its models using copyrighted material, arguing that doing so falls under the US fair use doctrine when using publicly available music files from the open internet.
The RIAA has also alleged that Suno deliberately bypassed YouTube's copyright protections by "stream ripping" music from the platform. The newly leaked files reportedly support those allegations, according to 404 Media.
One internal file cited in the report indicates that Suno had collected more than 2 million audio clips from YouTube Music at the time the data was last updated.
Other documents reportedly show that the company's datasets included hundreds of thousands of hours of audio from YouTube Music, alongside thousands of hours sourced from Deezer, Genius, IMSLP, Jamendo and Pond5. The files also suggest Suno gathered audio from Freesound and lyrics from MuseScore, while code reportedly showed plans to download around one million hours of podcasts through PodcastIndex.
The leaked code also indicates that Suno may have used the data collection service Bright Data to scrape content from YouTube. Some of the code searched specifically for a cappella versions of songs to obtain isolated vocal recordings.
Responding to the allegations, a Suno spokesperson told 404 Media that the company's AI models had been trained on "publicly available music files and related metadata accessible on third-party websites on the open Internet", a position the company has previously outlined in court filings and public disclosures.
The hacking incident also reportedly exposed customer information, including email addresses, phone numbers and Stripe payment details. Several customers contacted by 404 Media confirmed they had accounts with Suno and said they had not been informed of any security breach.
