Suno Captures Millions of Tracks from YouTube, Genius, and Deezer
Data leaked from a recent hacking incident has revealed that the AI music generator Suno was trained by scraping millions of songs and lyrics from various online audio platforms, including YouTube Music, Deezer, and Genius. This information provides a rare insight into Suno’s training datasets, which the company has previously kept under wraps.
This revelation is significant, especially since Suno is facing multiple lawsuits claiming it used copyrighted materials to develop its AI models. In a prominent case brought by the Recording Industry Association of America (RIAA), Suno acknowledged using copyrighted content, arguing that its practices fall under fair use due to the nature of publicly available music files on the internet. However, the RIAA’s amendment last year also accused Suno of unlawfully bypassing YouTube’s copyright protections by “stream ripping” tracks from the platform.
The hacker, known as “ellie.191,” provided materials that support these claims. The leaked data includes Suno’s source code from 2023 and 2024, along with instructions for scraping audio files from platforms like YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, and the International Music Score Library Project (IMSLP). Additional leaked code indicates that Suno may have employed a third-party service called Bright Data to scrape music from YouTube, specifically searching for a cappella versions to obtain vocal-only audio.
One file related to YouTube Music reveals that Suno had processed over 2 million clips from the platform at the time of the last update. Other documents show that Suno’s datasets included hundreds of thousands of hours of content from YouTube Music, Deezer, Genius, IMSLP, Jamendo, and Pond5, as well as significant amounts of Freesound and MuseScore lyrics. Furthermore, Suno aimed to download around one million hours of podcasts using a tool called PodcastIndex.
A spokesperson for Suno stated, “As we have stated in public filings and disclosures, Suno’s AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet.”
The hacker also accessed customer information, including email addresses, phone numbers, and payment details. Some customers confirmed to an outlet that they had signed up for Suno’s service and were not informed about the security breach.
In response, a Suno spokesperson mentioned that the company became aware of a security incident in November 2025 and acted swiftly to contain it. They stated, “At the time, we immediately conducted an investigation and verified that the incident primarily involved outdated source code that is no longer in use at Suno and that no sensitive personal information was compromised. Importantly, Suno does not have access to customers’ full credit card numbers in Stripe. Based on the limited nature of the customer information believed to be involved, we determined that individual notifications were not warranted under applicable privacy laws.”
