Suno is facing fresh scrutiny after a newly reported hack revealed more details about how the AI music company gathered training data for its music generation models, including content scraped from platforms such as YouTube Music, Deezer, and Genius.
According to a report by 404 Media, the leaked source code showed that Suno's data collection pipeline pulled music and metadata from several online sources, including YouTube Music, Deezer, Genius, Freesound, Jamendo, and the International Music Score Library Project. Internal comments reportedly referenced datasets containing millions of music clips and thousands of hours of audio gathered from these services.
The breach also reportedly exposed parts of Suno's customer database, including email addresses, phone numbers, and Stripe payment details. In response, the company said the incident was contained after it was discovered in November 2025, adding that the exposed source code was outdated and that no sensitive payment information had been compromised. Suno also said it did not believe the breach warranted notifying users.
The latest revelations arrive as AI companies continue to face growing legal and ethical questions over how generative music models are trained. Suno has previously acknowledged that its models were built using publicly accessible music files and metadata found across the open internet, while maintaining that its practices fall under fair use.
The company is currently defending itself against multiple copyright lawsuits filed by major record labels and music industry organisations, including Universal Music Group, Sony Music Entertainment, and the Recording Industry Association of America. Warner Music Group, meanwhile, settled its lawsuit with Suno and is now collaborating with the company on a new AI music model.
In a statement, Suno reiterated that its goal is to help users create original music rather than replicate existing artists. The company said it intentionally excludes artist names from its training metadata and has implemented safeguards designed to block prompts using specific artist, song, or album names, as well as uploads that match existing copyrighted recordings or lyrics.
Like what you read? Show our writer some love!
1