Hacked Suno Source Code Reveals AI Music Startup Scraped YouTube and Deezer, Bolstering Labels' Case

The recent breach of AI music company Suno has unveiled significant details regarding its data collection practices, particularly its scraping of content from major platforms like YouTube Music, Deezer, and Genius. This revelation, reported by 404 Media, adds a new layer to the ongoing copyright lawsuit initiated by two of the largest record labels in the world, Universal Music Group and Sony Music Entertainment. The implications of this breach extend beyond mere data security, touching upon fundamental issues of copyright infringement and fair use in the evolving landscape of AI-generated content.

Details of the Breach

The hacked source code was obtained by a hacker who infiltrated Suno's systems and subsequently shared the information with 404 Media. This breach not only exposed the company's data collection methods but also revealed sensitive information about hundreds of thousands of Suno customers, including their email addresses, phone numbers, and payment details linked to their accounts via Stripe.

The leaked code corroborates claims made by Universal Music Group and Sony Music Entertainment in their lawsuit against Suno, which is being coordinated by the Recording Industry Association of America (RIAA). In a court filing, Suno admitted that its AI models were trained on music available on the open internet, asserting that such use qualifies as fair use under copyright law. The company claimed it respected paywalls and password protections while gathering training data.

The specifics of the hacked code indicate that Suno utilized a range of sources to compile its datasets. Internal comments within the code identified platforms such as Genius, YouTube Music, Freesound, Jamendo, and Deezer as sources for its data collection. Notably, the code revealed that the system had ingested over 2 million individual music clips, with a staggering total of more than 113,000 hours of audio attributed to YouTube Music alone. The scale of this data collection raises serious questions about the legality and ethics of Suno's practices.

Allegations of Copyright Infringement

The revelations from the hacked code lend specificity to the allegations central to the record industry's lawsuit against Suno. In an amended complaint filed in September 2025, the RIAA accused Suno of stream-ripping recordings directly from YouTube and circumventing the platform's encryption safeguards designed to prevent unauthorized downloads. The leaked data appears to confirm these allegations, suggesting that Suno's practices may violate not only copyright law but also the anti-circumvention provisions of the Copyright Act.

The financial implications of this case are substantial. The record labels are seeking statutory damages of up to $150,000 for each infringed work, alongside penalties for circumvention acts. In a significant development, Universal and Sony have requested the court to expand the scope of the case from 560 identified works to over 61,000, which could potentially increase the maximum statutory damages from approximately $84 million to more than $9 billion. The court has yet to rule on this request, but the stakes are undeniably high.

In response to the breach and the ensuing report, a Suno spokesperson stated that the company’s AI models were trained on publicly available music files and metadata accessible through third-party websites. They characterized the breach as a limited security incident, asserting that an internal investigation found the exposure primarily involved outdated source code. They also claimed that no sensitive personal information had been compromised and that they did not have access to full credit card numbers through their payment processor.

Implications for the Future

The ongoing legal battle between Suno and the record labels highlights the complexities surrounding copyright in the age of AI. As technology evolves, the lines between fair use and infringement become increasingly blurred, particularly in creative fields such as music and art. The case raises critical questions about how AI companies should navigate copyright laws while leveraging existing content to train their models.

For creators and technologists, this situation serves as a cautionary tale about the importance of understanding copyright law and the potential repercussions of data scraping practices. As the legal landscape adapts to the challenges posed by AI, it is essential for companies to develop transparent and ethical data collection strategies that respect the rights of original creators. The outcome of this case could set significant precedents for how AI technologies interact with intellectual property rights in the future, shaping the way content is created, shared, and monetized in the digital age.