Suno is already fighting to defend its AI training practices in court, and now a hacker has handed its opponents a receipt. A breach traced back to November 2025 exposed internal source code showing exactly how the AI music generator built its models, according to data shared with 404 Media. The files reportedly detail scraping across YouTube Music, Deezer, Genius, and several stock libraries, converting what had been a legal argument about “publicly available” training data into a documented, platform-by-platform paper trail.
For artists, that paper trail is the part that stings. Internal notes cited in the breach put YouTube Music scraping alone at over 2 million clips and nearly 114,000 hours, with tens of thousands more hours pulled from Genius and Deezer, meaning any independent or emerging producer whose tracks lived on those platforms may have fed directly into Suno’s models without ever being asked. It’s the kind of detail that’s been circulating as accusation for months in the ongoing lawsuits from major labels, who argue the YouTube scraping specifically violates the DMCA; this hack just turned that accusation into something closer to evidence.
Suno’s defense hasn’t changed. A company spokesperson called the breach “quickly contained,” saying it involved only “outdated source code no longer in use,” and maintained that no sensitive user data was compromised, though the hacker also claims to have accessed customer emails and payment details for hundreds of thousands of users. The company continues to point to its “Original Creation, By Design” approach, including filters meant to stop users from prompting with real artist or song names, as evidence it’s not in the business of replication. Whether that holds up against a leaked inventory of exactly whose work trained the model is now a question for the courts, and one a lot of working producers will be watching closely. 
