{"id":696516,"date":"2026-07-17T11:24:35","date_gmt":"2026-07-17T11:24:35","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/696516\/"},"modified":"2026-07-17T11:24:35","modified_gmt":"2026-07-17T11:24:35","slug":"suno-scraped-youtube-deezer-to-train-ai-hacked-code-reveals-potentially-strengthening-umg-and-sonys-legal-case","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/696516\/","title":{"rendered":"Suno scraped YouTube, Deezer to train AI, hacked code reveals – potentially strengthening UMG and Sony\u2019s legal case"},"content":{"rendered":"

Hacked source code from AI music company Suno lists YouTube Music<\/a>, Deezer<\/a>, and Genius<\/a> among the platforms it scraped to build its AI models, according to a report from 404 Media<\/a>\u00a0on Wednesday (July 15).<\/p>\n

The code was obtained by a hacker who breached Suno and shared it with the publication.<\/p>\n

The same hacker also accessed information on hundreds of thousands of Suno customers, including emails and\/or phone numbers, and Stripe payment details, according to the report.<\/p>\n

The hacked data corroborates the labels\u2019 allegation that Suno ripped songs directly from YouTube<\/a>, according to the report.<\/p>\n

Suno has already acknowledged in a court filing<\/a> that its training data was drawn from music across the open internet.<\/p>\n

The company is defending itself against Universal Music Group<\/a> and Sony Music Entertainment<\/a> in a copyright infringement lawsuit coordinated by the RIAA<\/a>, and argues that training on copyrighted works is protected as fair use.<\/p>\n

In that filing, Suno said its training data \u201cincludes essentially all music files of reasonable quality that are accessible on the open internet, abiding by paywalls, password protections, and the like.\u201d<\/p>\n

The hacked code names sources Suno drew on and logs the volume of material it took, according to 404 Media.<\/p>\n

Comments in one file said the system would pull from \u201cgenius_hq, youtube_music, freesound, jamendo, imp, deezer, ytm_tagged,\u201d and that \u201cnon-music will be filtered out,\u201d according to 404 Media.<\/a><\/p>\n

A file named \u201cyoutube_music\u201d recorded that it had ingested \u201c2,013,545 music clips,\u201d the publication reported.<\/p>\n

The datasets Suno built included 113,879 hours of material logged as youtube_music, plus a further 152,162 hours logged as ytm_tagged, according to the report.<\/p>\n

They also included 62,117 hours from the stock library Pond5, 19,514 hours from the International Music Score Library Project, 17,615 hours from Genius, and 12,287 hours from Deezer, the report said.<\/p>\n

In total, the material ran to at least decades of audio, according to 404 Media.<\/p>\n

Other code showed Suno searching for a capella versions of songs on YouTube, in what 404 Media said appeared to be an effort to isolate vocals.<\/p>\n

The code also indicated that Suno used proxies from a company called Bright Data to scrape songs from YouTube, according to the report.<\/p>\n

The code also showed Suno using a service called PodcastIndex to pull together some 420,000 podcasts, each with a minimum of five half-hour episodes, and attempting to download about a million hours of audio.<\/p>\n

404 Media said it was unclear from the files exactly how Suno scraped material from the other platforms.<\/p>\n

Pond5, a stock library owned by Shutterstock, says it holds 2.5 million music tracks, and Suno\u2018s data suggested it took a substantial portion of the library, according to the report.<\/p>\n

Genius does not host songs directly but lets Apple Music<\/a> subscribers play tracks and samples through its site.<\/p>\n

The YouTube scraping is already part of the record industry\u2019s lawsuit against Suno.<\/p>\n

In an amended complaint filed in September 2025, the RIAA accused Suno of \u201cstream ripping\u201d<\/a> recordings from YouTube and circumventing the platform\u2019s \u201crolling cipher\u201d encryption, which is designed to block unauthorized downloading.<\/p>\n

\u201cSuno obtained those copies in the first instance by unlawfully \u2018stream ripping\u2019 them from the popular streaming platform YouTube, and circumventing the technological measures designed specifically to prevent such unauthorized copying,\u201d the RIAA wrote in its lawsuit.<\/p>\n

404 Media said the hacked data confirmed the RIAA\u2018s claim that Suno took songs from YouTube.<\/p>\n

The labels argue that circumventing those measures breaches the anti-circumvention provisions of the Copyright Act.<\/p>\n

That claim sits apart from Suno\u2018s fair-use defense, which applies to the copying itself rather than to any bypassing of access controls.<\/p>\n

The labels are seeking statutory damages of up to USD $150,000 per work infringed, plus up to $2,500 for each act of circumvention.<\/p>\n

In May, UMG and Sony<\/a> asked the court to expand the case from 560 works to 61,026 that they identified in Suno\u2019s training data through audio fingerprinting \u2013 a jump that would lift the theoretical maximum in statutory damages from around $84 million to more than $9 billion. The judge has yet to rule.<\/p>\n

In a statement to 404 Media, a Suno spokesperson said: \u201cAs we have stated in public filings and disclosures, Suno\u2019s AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet.\u201d<\/p>\n

The spokesperson said Suno determined in November 2025 that it had been \u201cthe subject of a limited security incident that was quickly contained.\u201d<\/p>\n

\u201cAs we have stated in public filings and disclosures, Suno\u2019s AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet.\u201d<\/p>\n

suno spokesperson (via 404 Media)<\/p>\n

\u201cWe immediately conducted an investigation and verified that the incident primarily involved outdated source code that is no longer in use at Suno and that no sensitive personal information was compromised,\u201d the spokesperson said.<\/p>\n

\u201cImportantly, Suno does not have access to customers\u2019 full credit card numbers in Stripe,\u201d they added.<\/p>\n

The spokesperson said Suno had concluded that individual breach notifications \u201cwere not warranted under applicable privacy laws,\u201d and that the company had filed a training-data disclosure required under California law.<\/p>\n

The hacker, who uses the name ellie.191[,] told 404 Media they got in by hitting a Suno employee with Shai-Hulud, a supply-chain worm that scoops up GitHub and cloud-service logins.<\/p>\n

Some of the customers whose records were exposed confirmed to 404 Media\u00a0that they had not been notified of a breach.<\/p>\n

The hacker said they had no specific motivation, telling 404 Media: \u201cI like to hack anything and everything.\u201d<\/p>\n

Deezer, one of the platforms named in the code, is a subscription service that has positioned itself as a prominent player in the identification of AI-generated music.<\/p>\n

The company says its tool identifies tracks from models such as Suno and Udio<\/a> with 99.8% accuracy, and that it was the first streaming service to tag AI music at the platform level.<\/p>\n

Deezer says it tagged more than 13.4 million AI tracks across 2025 and removed fully AI-generated music from its recommendations.<\/p>\n

Suno\u2018s court filing said its training data was gathered \u201cabiding by paywalls, password protections, and the like.\u201d<\/p>\n

Both Deezer and Pond5, named in the hacked code, require payment for access.<\/p>\n

Jamendo, the Luxembourg-based licensing platform named in the code, is separately suing Suno. It filed a copyright infringement claim on June 29 in the same Massachusetts court, alleging Suno trained on a roughly 55,600-track dataset, licensed for non-commercial academic use only, without paying for a commercial licence.<\/p>\n

Jamendo is seeking at least \u20ac17.8 million ($20 million).<\/p>\n

Warner Music Group<\/a>, a former co-plaintiff, exited the case after settling with Suno in November 2025<\/a> and entering a licensing partnership that included Suno\u2018s acquisition of Songkick.<\/p>\n

Suno raised more than $400 million in funding in June.<\/p>\n

404 Media has previously reported that Nvidia<\/a> and Runway ML<\/a> also scraped YouTube to gather training data. The Nvidia article led to a class action lawsuit<\/a> against the company in 2025.<\/p>\n

Meanwhile, the Suno spokesperson said the company builds its models around what it calls \u201cOriginal Creation, By Design,\u201d and does not use artist names as a category of training metadata.<\/p>\n

\u201cWe believe artists deserve both new opportunities and strong protections,\u201d the Suno spokesperson said.<\/p>\n

Mikey Shulman, Suno\u2018s CEO and founder, said on a podcast last year that he believes the \u201cmajority of people don\u2019t enjoy the majority of the time they spend making music.\u201dMusic Business Worldwide<\/p>\n","protected":false},"excerpt":{"rendered":"Hacked source code from AI music company Suno lists YouTube Music, Deezer, and Genius among the platforms it…\n","protected":false},"author":2,"featured_media":696517,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[554,733,4308,86,56,54,55],"class_list":["post-696516","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/696516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=696516"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/696516\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/696517"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=696516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=696516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=696516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}