Suno Leak: AI Models Apparently Trained with Music from YouTube and Deezer

An attacker has gained access to internal systems of the AI music service Suno and shared data from them with the US tech publication 404 Media. This includes information Suno's training libraries. These suggest that Suno has trained its AI music generator with millions of music pieces and lyrics, which originate from YouTube Music, Deezer, and Genius, among others. The company also allegedly collected podcast audio on a large scale.

While it was already known from ongoing copyright proceedings that Suno used large amounts of protected works for training purposes, the leaked data, according to 404 Media, provides a more precise insight into the sources from which the training material originates and how it was obtained.

The findings include source code files, apparently from 2023 and 2024, which contain scraping instructions and information on the scope of individual datasets. One file lists more than two million music clips read from YouTube Music. For other data collections, mention scopes of a good 100 to more than 150,000 hours of audio. Via PodcastIndex, Suno identified around 420,000 podcasts and intended to download one million hours of podcast audio.

According to the perpetrator, the Shai-Hulud worm was used in the attack to compromise a Suno employee and steal their access credentials for GitHub and cloud services. The attacker allegedly used these to access internal systems and a customer list with email addresses, phone numbers, and details Stripe payments.

Suno confirmed to 404 Media a security incident in November 2025, but described it as limited and quickly contained. It primarily affected outdated source code, and sensitive personal data was not compromised. Suno stated that it does not have access to its customers' full credit card numbers anyway. The company also defended the origin of the training data. Suno referred to court documents and disclosures , according to which its models were trained with publicly accessible music files and metadata from the open internet.

Several major record labels sued Suno in 2024 for alleged copyright infringement. Suno admitted to training its models with tens of millions of recordings and invoked Fair Use . A judicial clarification of this fundamental question is still pending. Warner settled its part of the lawsuit in November 2025 as part of a licensing partnership, while the lawsuits from Universal and Sony are ongoing. In Germany, the GEMA is also taking action against Suno ; the Munich I Regional Court is scheduled to announce its decision on July 31, 2026 (File No. 42 O 763/25).

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.