Suno Hack Reveals Millions of Copyrighted Songs Used to Train AI Music Generator, Fueling Ongoing Label Lawsuits

A recent security breach of Suno, the AI‑generated music platform, has exposed the company’s training data and confirmed allegations that it used millions of copyrighted recordings without permission. The hack, reported by 404 Media and covered by outlets such as CNET, TechCrunch, and Variety, revealed that Suno’s models were trained on songs and lyrics scraped from YouTube Music, Deezer, Genius, and several stock‑music libraries.

The breach arrived at a time when Suno is already the target of lawsuits from Universal Music Group (UMG) and Sony Music Entertainment (SME). Both labels have accused the company of infringing copyright by ingesting large volumes of unlicensed works. The new evidence from the hack supports the labels’ claims and could broaden the scope of the litigation.

According to the hacked source code, Suno’s data‑collection scripts accessed public tracks on YouTube Music and Deezer, downloaded full‑length audio files, and extracted lyrics from Genius. The code also included instructions for pulling tracks from commercial stock‑music libraries that are typically licensed for specific uses. The volume of material is described as “millions” of songs, a figure that aligns with the number of tracks the labels have identified in their filings.

Suno has previously acknowledged that its training data included copyrighted material. In a legal filing, the company stated that “essentially all music films of reasonable quality that are accessible on the open internet” were acceptable for training under fair‑use arguments. The hack confirms that the company’s scraping practices extended to major streaming platforms, a fact that the labels have cited in their lawsuits.

Artists have voiced strong objections to the use of their work in AI training. SZA, for example, has said she believes even some of her unreleased songs were used without consent, arguing that AI exploitation disproportionately harms Black artists. Kenneth Blume, a composer and producer, has similarly criticized the practice, calling it a violation of creators’ rights. These statements have added a human dimension to the legal debate, highlighting the potential economic impact on individual musicians.

The hacker who accessed Suno’s code has not been identified. In an interview with 404 Media, the individual denied having a vendetta against AI music or Suno specifically, describing their motivation as “random” and stating, “I like to hack anything and everything.” The hacker’s comments suggest the breach was not a targeted attack on the company’s business model but rather a general act of intrusion.

The implications for the AI music industry are significant. Suno’s acquisition of the concert‑discovery app Songkick in 2025 positioned the company as a major player in both live‑event promotion and AI‑generated content. The hack’s revelations could affect Suno’s relationships with streaming partners and its ability to secure licensing agreements. For the broader market, the incident underscores the need for clearer guidelines on data sourcing for AI training and may influence how other AI music startups approach compliance.

UMG and SME have already moved to expand their lawsuit against Suno. In May 2026, the labels filed to add more than 61,000 identified recordings to the case, a request that was granted by a federal court. The new evidence from the hack may support the labels’ argument that Suno’s training set included a broader range of copyrighted works than previously documented.

Suno’s legal team has not yet issued a public statement regarding the breach. The company’s status in the ongoing litigation remains uncertain, and the outcome of the expanded lawsuit could set a precedent for how AI‑generated music services are held accountable for the use of copyrighted material.

In summary, the Suno hack has confirmed that the AI music generator trained on large volumes of copyrighted songs from major streaming platforms and stock‑music libraries. The evidence supports the claims of UMG and SME, adds urgency to the legal dispute, and highlights the broader challenges of data sourcing in AI music creation.