- Hacked Code: Hacked code contains instructions for collecting music and lyrics from several online services in 2023 and 2024.
- Collection Scale: One leaked file appears to log 2,013,545 clips, while dataset notes assign hundreds of thousands of service hours.
- Legal Stakes: Record labels allege stream ripping and circumvention, while Suno maintains that the exposed code is outdated.
- Unresolved Evidence: The files remain unauthenticated, and Suno denies that sensitive customer data was compromised.
Hacked code shared with 404 Media shows how AI music generator Suno scraped music and lyrics from online services in 2023 and 2024. Since then Suno and Warner Music Group entered a partnership after Suno’s Warner Music settlement in November 2025.
Named services include YouTube Music, Deezer, Genius, stock-media marketplace Pond5, and others, while the historical activity predates the major labels’ copyright case against Suno.
A leaked youtube_music file appears to have logged 2,013,545 ingested clips when last updated. For artists and rights holders, the figure gives a measurable view of the collection attributed to one service. It does not establish how much material entered a production model.
Allegations involving millions of songs and lyrics could add factual detail to the copyright fight major labels opened. Suno maintains that the exposed code was outdated and no longer in use, that its models trained on publicly accessible internet files, and that no sensitive personal information was compromised during the November 2025 security incident.
The commercial stakes are substantial. Suno raised more than $400 million in June 2026 and reached a $5.4 billion valuation after the financing.
Suno completed ists settlement with Warner Music before the files surfaced.
How the Alleged Collection Worked
Instructions reportedly dated to 2023 and 2024 cover collection from YouTube Music, Deezer, lyrics service Genius, Pond5, Jamendo, Freesound, the International Music Score Library Project, and podcast feeds. Dataset annotations assigned 113,879 hours to YouTube Music, 62,117 hours to Pond5, 17,615 hours to Genius, and 12,287 hours to Deezer.
Suno appears to have scraped songs from YouTube using proxy services, which distribute requests through intermediary connections. Searches for a cappella recordings targeted vocal-only audio, while separate instructions pointed to an attempted collection of about one million podcast hours with help from PodcastIndex.
Targeted searches, intermediary connections, and service-specific instructions outline a designed acquisition pipeline.
Compromised employee credentials may have given the hacker using the alias ellie.191 access to Suno’s source code after a November 2025 supply-chain attack. Independent authentication is necessary before courts can treat each instruction or dataset annotation as genuine.
Record-label plaintiffs make a more pointed allegation in their litigation:
“Suno obtained those copies in the first instance by unlawfully ‘stream ripping’ them from the popular streaming platform YouTube, and circumventing the technological measures designed specifically to prevent such unauthorized copying.”
Recording Industry Association of America, representing major record companies (via court filing)
Stream ripping means capturing streamed media as a downloadable file while bypassing copying controls. Courts have not accepted the allegation as fact so far. Authentication could make the claimed method relevant to circumvention, a legal issue separate from whether model training qualifies as fair use.
Copyright Stakes and Unresolved Questions
Several major labels sued Suno, alleging copyright infringement. Suno later invoked the fair use doctrine argument, arguing that training enables new output rather than substituting for recordings. Specific acquisition mechanics now give courts another disputed issue to assess alongside that defense.
Warner Music Group settled its Suno lawsuit and entered a partnership on November 25, 2025. Licensed model development and opt-in uses under the agreement cover participating artists’ names, images, likenesses, voices, and compositions.
Future models are planned to compensate participating artists, making consent and payment part of their design. Suno scheduled the first music model developed with industry partners to begin rolling out in the months after June 2026, describing it as a future rollout rather than an available release.
Musician Kenneth Blum, better known as Kenny Beats, condemned the alleged collection’s impact on working artists:
“I can’t imagine going into work daily knowing you are stealing from countless struggling musicians. I can’t imagine being proud to earn a paycheck obliterating the work and dreams of artists.”
Kenneth Blum, musician also known as Kenny Beats (via X)
Ellie.191, who shared the details about Suno’s scraping, appears to have accessed customer information for hundreds of thousands of users, including contact details and information held by payment processor Stripe. Suno denies that sensitive personal data was compromised.
