Suno Hack Exposes 2 Million Scraped YouTube Songs

This story is built on source code and internal documentation that a hacker exfiltrated from Suno's systems in November 2025 and shared with 404 Media, plus the company's public response once the leak surfaced this week. Suno calls it old news. The labels suing the company call it confirmation.

What the Leaked Files Say

The Company's Own Words

"As we have stated in public filings and disclosures, Suno's AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet."

Suno issued that statement after 404 Media published its report on July 15. The company also said it determined in November 2025 that it had been "the subject of a limited security incident that was quickly contained," and that "no sensitive personal information was compromised." Hundreds of thousands of customer records, including Stripe payment details, were also exposed in the same breach, though Suno maintains that the exposed code was old and no longer in production.

That framing does not sit well with what the leaked training manifest actually shows.

The Federal Complaint

Suno has been fighting a copyright suit from the major labels since mid-2024, and the amended complaint filed on September 19, 2025 already spelled out the theory the leak now backs with code.

Suno "acquired many (if not all) of the copyrighted sound recordings in its training data by illicitly downloading them from YouTube using a notorious method of music piracy known as 'stream ripping.'"

The complaint describes YouTube's "rolling cipher," an encryption scheme that assigns a hidden file URL to every video specifically to block unauthorized downloads. Bypassing it is a DMCA violation independent of any copyright infringement claim over the songs themselves.

The Scraping Manifest

The leaked code names Bright Data, a commercial scraping-infrastructure vendor, as the tool used to pull audio out of YouTube. Reporting on the leak also describes routines built to search specifically for acapella versions of tracks, useful for isolating vocal stems during training. Suno's rivals face the same accusation: Udio is fighting nearly identical claims over YouTube scraping in a separate suit.

The manifest's platform-by-platform numbers, as reported by 404 Media, run well beyond YouTube:

For scale, our Suno review from February already noted the platform had built its catalog on nearly 100 million users' worth of produced tracks. The manifest suggests the training side of that business ran on the same scrape-first, ask-forgiveness-later playbook that built Suno's competitors too, including efforts like Stability's Stable Audio 3 that lean on licensed and synthetic data specifically to avoid this exposure.

The leaked manifest lists over 2 million clips pulled from YouTube Music, more than any other single source. Source: unsplash.com

What the Documents Don't Say

The leak has real gaps. Suno hasn't explained what makes the exposed code "outdated" or whether current commercial models, the ones creating songs for paying subscribers today, were built on data collected through this exact pipeline. Nobody has independently audited the manifest's authenticity beyond the outlets that reviewed the leaked files, though 404 Media, TechCrunch, and Engadget all describe consistent figures. The hacker's motive is also unclear. Their only stated reason, relayed to 404 Media, was that they "like to hack anything and everything."

There's also no accounting yet for how Deezer, Genius, or the other named platforms plan to respond. None had issued a public statement about the leak as of publication.

The Verdict

There's no court ruling on the leak itself, but the litigation it feeds into is very much live. Warner Music Group settled with Suno in November 2025, turning the label into a licensing partner instead of a plaintiff. UMG and Sony didn't settle, and in May they escalated: a motion filed May 21, 2026 in the U.S. District Court for the District of Massachusetts seeks to add 61,026 recordings to the case after the labels used Audible Magic's audio-fingerprinting service to identify their catalog inside Suno's training data. Suno formally opposed the motion on June 4. Chief Judge F. Dennis Saylor IV hasn't yet ruled on whether to allow it.

The stakes moved with the filing. The original complaint covered around 560 works, carrying a theoretical maximum of roughly $84 million in statutory damages. At the $150,000-per-work ceiling, 61,026 works would push that ceiling past $9 billion.

UMG and Sony's case against Suno is pending in the U.S. District Court for the District of Massachusetts. Source: unsplash.com

The leaked manifest doesn't create new legal exposure on its own. It backs up, in granular detail, the exact allegation UMG and Sony's lawyers have been making since before the hack was ever disclosed.

Sources:

• 404 Media: Hack Reveals Suno AI Music Generator Scraped YouTube, Deezer, and Genius
• TechCrunch: Hack suggests AI music generator Suno scraped YouTube for training data
• Engadget: A hacker accessed Suno source code that reportedly details how the company scraped millions of songs
• Music Business Worldwide: UMG and Sony seek to add over 61k recordings to Suno lawsuit
• Rolling Stone: AI-Music Heavyweight Suno Partners With Warner Music Group After Lawsuit Settlement