Hacked Suno Source Code Reveals Extensive Scraping of YouTube and Other Platforms

A hacker breached AI music generator Suno in November 2025, exposing source code that details the company's massive scraping of copyrighted music for training data. The incident provides a rare glimpse into Suno's training datasets, which the company had largely kept secret.

What was scraped

The leaked code shows Suno scraped over 2 million clips from YouTube Music, along with tens of thousands of hours from Deezer, Genius, and stock libraries like Pond5 and IMSLP. It also targeted a cappella versions on YouTube to capture clean vocals, using a proxy service called Bright Data to evade YouTube's protections. Additionally, Suno sought roughly one million hours of podcasts via PodcastIndex. Source: Gizmodo, The Verge

The hack and customer data

The hacker, going by ellie.191, used a supply chain attack (the Shai-Hulud worm) to access an employee's credentials, pulling source code from 2023–2024 and customer data including emails, phone numbers, and Stripe payment details. Suno acknowledged the breach but said it was "quickly contained" and that no sensitive personal information was compromised. However, affected customers reported they were never notified individually. Source: TechCrunch, The Next Web

Legal context

Suno faces several lawsuits from major labels and the RIAA, alleging copyright infringement. The company has admitted training on "publicly available music files" but argues it is protected under fair use. Meanwhile, some labels like Warner Music have signed licensing deals with Suno instead of litigating. A pivotal fair-use ruling is expected this summer. Source: Engadget, The Next Web