Suno AI Hack Reveals Extensive Scraping of Streaming and Lyric Services
In November 2025, a supply‑chain attack on Suno AI exposed a trove of code that detailed how the company harvested music and lyrics from dozens of major online platforms. The compromised source files were shared with 404 Media in July 2026, revealing that Suno had collected more than two million audio clips and hundreds of thousands of hours of content from services such as YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, the International Music Score Library Project (IMSLP), and various podcast feeds.
The breach stemmed from compromised employee credentials. The attacker, who went by the alias ellie.191, accessed Suno’s code repository and extracted a file that logged 2,013,545 ingested clips. Within that file, dataset annotations assign 113,879 hours to YouTube Music, 62,117 hours to Pond5, 17,615 hours to Genius, and 12,287 hours to Deezer. The code also contains instructions for using proxy services—reported to be Bright Data—to download songs from YouTube, targeted searches for a‑capella recordings, and an attempt to amass roughly one million podcast hours via PodcastIndex.
Suno’s spokesperson said the exposed code is “outdated and no longer in use.” The company claimed the hack was quickly contained after it became aware of the breach in November 2025. Suno also stated that its models were trained on publicly accessible internet files and that no sensitive personal data was compromised, although the hacker’s access included contact details for hundreds of thousands of users and information held by the payment processor Stripe.
The incident intersects with ongoing legal disputes. The Recording Industry Association of America (RIAA) has sued Suno for copyright infringement, alleging that the company “stream‑ripped” content from YouTube and bypassed technological protections. Suno has defended its training data under the fair‑use doctrine, arguing that the model’s output does not substitute for the original recordings. The new evidence of scraping instructions adds a technical dimension to the court’s assessment of whether Suno’s methods constitute infringement.
In November 2025, Suno settled its lawsuit with Warner Music Group (WMG) and entered a partnership that allows the company to develop licensed AI models using opt‑in artist data. The agreement covers artists’ names, images, likenesses, voices and compositions, and future models are planned to compensate participating artists. Suno scheduled the first rollout of a licensed model in the months following June 2026.
The hack has drawn criticism from artists. Musician Kenneth Blum, known as Kenny Beats, posted on X that he could not imagine working while “stealing from countless struggling musicians.” His statement highlights concerns that AI training may undermine the livelihoods of creators.
Suno’s recent funding round, announced in June 2026, raised more than $400 million and valued the company at $5.4 billion. The partnership with WMG and the potential for licensed, artist‑compensated models could represent significant revenue opportunities, but the legal uncertainty surrounding data scraping and copyright may affect future product development.
At present, the hack has been contained and the code in question is no longer active. Suno’s legal disputes continue, and the settlement with WMG remains in effect. The industry is monitoring how courts interpret the new evidence and whether it will influence the broader debate over AI training data and copyright.
