{"id":551570,"date":"2026-07-15T20:55:23","date_gmt":"2026-07-15T20:55:23","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/551570\/"},"modified":"2026-07-15T20:55:23","modified_gmt":"2026-07-15T20:55:23","slug":"hack-reveals-suno-ai-music-generator-scraped-youtube-deezer-and-genius","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/551570\/","title":{"rendered":"Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius"},"content":{"rendered":"

The AI music generation tool Suno scraped millions of songs and lyrics from YouTube Music, Deezer, and Genius, as well as from the stock music libraries Pond5, Jamendo, Freesound, the International Music Score Library Project, and podcasts via RSS feeds, according to a hacker who breached the company and shared data about Suno\u2019s training libraries with 404 Media. The hacker was also able to access user information for hundreds of thousands of Suno\u2019s customers, as well as Stripe payment information, they said.<\/p>\n

The hacked data is a rare look at exactly how AI models and tools are built. Suno is one of the largest AI music generation tools on the internet, and has been the subject of several major lawsuits<\/a> from the record industry, which accused the company of training on millions of copyrighted songs. As part of these legal proceedings<\/a>, Suno previously admitted that it was trained on \u201cessentially all music files of reasonable quality that are accessible on the open internet,\u201d which included a total of \u201ctens of millions of recordings.\u201d Suno has been making the argument that it is allowed to train on copyrighted works as fair use in those cases, one of which has been settled.\u00a0<\/p>\n

The lawsuits have made clear that Suno did train on huge amounts of copyrighted works, but the hacked data shared with 404 Media sheds more light on how Suno scraped songs from the internet and where it took them from. The Recording Industry Association of America accused Suno of ripping songs directly from YouTube<\/a>; the hacked data seen by 404 Media confirms this.<\/p>\n

The hacked material includes source code that appears to be from 2023 and 2024 that includes scraping instructions and details about the scope of at least some of the scraping. For example, the comments in one file note that they will pull from \u201cgenius_hq, youtube_music, freesound, jamendo, imp, deezer, ytm_tagged,\u201d and that \u201cnon-music will be filtered out.\u201d A file called \u201cyoutube_music\u201d notes that at the time the file was last updated, it had ingested \u201c2,013,545 music clips.\u201d Another file contains comments about different datasets Suno had created, which included \u201c113,879 hours of youtube_music,\u201d \u201c17,615 hours of genius_hq,\u201d \u201c410 hours of free sound,\u201d \u201c19,514 hours of imslp,\u201d \u201c3,726 hours of jamendo,\u201d \u201c62,117 hours of pond5_music,\u201d \u201c12,287 hours of deezer,\u201d \u201c152,162 hours of ytm_tagged,\u201d and \u201c103 hours of musescore_lyrics.\u201d In total, this is at least decades worth of music.\u00a0<\/p>\n

\"\"<\/p>\n

Other code the hacker shared with 404 Media appeared to look specifically for vocals by searching specifically for acapella versions of songs on YouTube. The code also suggested that Suno was using proxies to scrape songs from YouTube through a company called Bright Data<\/a>, which sells scraping tools, infrastructure, and data services. Additional code shows that with the help of an online tool called PodcastIndex<\/a>, Suno identified 420,000 different podcasts that had at least five, 30-minute episodes and sought to download roughly 1 million hours of podcasts.<\/p>\n

It is unclear from the files seen by 404 Media exactly how Suno scraped files from each of the other platforms. Pond5 is a stock music and sound effects library owned by Shutterstock in which customers pay to access songs individually or can access a limited number of songs per month with a subscription. Pond5 claims it has 2.5 million music tracks; Suno\u2019s data suggests that it scraped a substantial amount of the entire library. Genius, meanwhile, does not host songs directly on its website but allows Apple Music subscribers to play music through the website or to play samples of songs through Apple Music.\u00a0<\/p>\n

\"\"<\/p>\n

In one of its lawsuit filings<\/a>, Suno said that its \u201ctraining data includes essentially all music files of reasonable quality that are accessible on the open internet, abiding by paywalls, password protections, and the like, combined with similarly available text descriptions,\u201d and that it was \u201cconstructed by showing the program tens of millions of instances of different kinds of recordings gathered from publicly available sources.\u201d\u00a0<\/p>\n

\u201cFor Suno specifically, this process involved copying decades worth of the world\u2019s most popular sound recordings and then ingesting those copies into Suno\u2019s AI models so they can generate outputs that imitate the qualities of genuine human sound recordings,\u201d the RIAA wrote in its lawsuit against Suno. \u201cAnd to make matters worse, Suno obtained those copies in the first instance by unlawfully \u2018stream ripping\u2019 them from the popular streaming platform YouTube, and circumventing the technological measures designed specifically to prevent such unauthorized copying.\u201d<\/p>\n

In a statement, a Suno spokesperson said \u201cAs we have stated in public filings and disclosures, Suno\u2019s AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet. In November of 2025, we determined that Suno had been the subject of a limited security incident that was quickly contained. At the time, we immediately conducted an investigation and verified that the incident primarily involved outdated source code that is no longer in use at Suno and that no sensitive personal information was compromised. Importantly, Suno does not have access to customers\u2019 full credit card numbers in Stripe.\u201d\u00a0<\/p>\n

\u201cBased on the limited nature of the customer information believed to be involved, we determined that individual notifications were not warranted under applicable privacy laws,\u201d the Suno spokesperson added. Suno also sent a training data disclosure<\/a> required under California law.<\/p>\n

The hacker, ellie.191, told 404 Media they breached the company by hacking an individual employee using the Shai-Hulud worm<\/a>, a supply chain attack that allowed hackers to harvest GitHub and cloud service credentials. They said they also accessed Suno\u2019s customer list, which included customers\u2019 emails and\/or phone numbers and Stripe payment details, depending on what they used to login. The hacker provided a sample of some of the customers, some of whom confirmed to 404 Media they had used their phone number to sign up for Suno and said they were never notified of a breach. The hacker told 404 Media they had no specific motivation for hacking Suno and said \u201cI like to hack anything and everything.\u201d<\/p>\n

404 Media has previously reported on leaked materials that showed Nvidia<\/a> and Runway ML scraped YouTube en masse<\/a>. For the most part, AI companies no longer deny training on copyrighted materials and instead make the argument that they are allowed to scrape artists\u2019 work under fair use carveouts in copyright law.\u00a0<\/p>\n

Last month, The Atlantic reported on several music databases<\/a> that are widely used in AI training, consisting of millions of tracks: \u201cThree of the datasets I found are distributed as a list of links to songs on YouTube or Spotify. AI developers download the actual audio using tools that automate the job, some of which allow developers to bypass logins, advertisements, and mechanisms that might earn money or subscribers for creators. Such tools violate the terms of service of these platforms. (The fourth dataset, the Free Music Archive collection, is distributed with MP3s.),\u201d the author of The Atlantic piece wrote. It is unclear whether Suno used any of these datasets.\u00a0<\/p>\n

The Suno spokesperson added that the company has worked to try to prevent users from generating songs that sound like existing songs. One of the contentions of several of the lawsuits was that Suno could be used to output songs that are nearly indistinguishable from existing works. \u201cOur goal has always been to help people create original new music, not replicate someone else\u2019s. That\u2019s why we build our models around what we call \u2018Original Creation, By Design.\u2019 For example, we intentionally do not use artist names as a category of training metadata because we want our models to help people create brand new songs, not music that replicates other artists\u2019 existing work,\u201d the spokesperson said. \u201cWe believe artists deserve both new opportunities and strong protections. That’s why we’ve invested in safeguards designed to help prevent impersonation, and other forms of misuse, while continuing to develop technologies for AI identification.\u201d<\/p>\n

Mikey Shulman, the CEO and founder of Suno, said on a podcast last year<\/a> that he believes the \u201cmajority of people don\u2019t enjoy the majority of the time they spend making music.\u201d<\/p>\n

About the author<\/p>\n

Jason is a cofounder of 404 Media. He was previously the editor-in-chief of Motherboard. He loves the Freedom of Information Act and surfing.<\/p>\n

\"Jason <\/p>\n","protected":false},"excerpt":{"rendered":"The AI music generation tool Suno scraped millions of songs and lyrics from YouTube Music, Deezer, and Genius,…\n","protected":false},"author":2,"featured_media":551571,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[220,218,219,61,60,80],"class_list":["post-551570","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/551570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=551570"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/551570\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/551571"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=551570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=551570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=551570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}