Leaks reveal that Suno has integrated thousands of hours of Deezer, YouTube, and Pond5 data into its artificial intelligence.

A hacker has breached Suno’s AI-powered music platform and walked away with source code that documents in minute detail the exact source of the company’s training data.

It was rags First reported by 404 Mediawho reviewed the leaked files. It confirms what the music industry has been saying in courts since 2024.

The intruder claims to have used a piece of malware called the Shay Hollowworm – named after the huge sandworms in Frank Herbert’s Dunes. Suno, one of the largest AI-powered music generators online, allows users to write a text description and get a full song in seconds; Building this ability requires a large training dataset – a collection of audio files used to teach the model what different genres and styles sound like.

The leaked material consists of internal instructions and logs from 2023 and 2024, providing a rare look at how these pipelines were actually assembled.

The distribution of the data set is specific. According to internal file comments he reviewed 404 media,The training library included 113,879 hours of YouTube music, 152,162 hours of tagged YouTube tracks, 62,117 hours of Pond5 stock music library, 12,287 hours of Deezer, and 17,615 hours in a dataset named genius_hq, linked to material collected through Genius. The code also documented plans to download approximately 1 million hours of streaming audio via RSS feeds.

One internal file tracking YouTube music intake alone recorded 2,013,545 music tracks. These millions of recordings span decades of sound, and the appetite isn’t limited to music.

The hacker claimed to have accessed records associated with hundreds of thousands of customers, including emails, phone numbers, and Stripe-related information. Sonu doubts that sensitive personal information is at risk.

The company says it identified the incident as November 2025 and described it as “limited.” Suno determined that the exposure primarily related to legacy source code that was no longer in use and concluded that individual customer notifications were not required under applicable privacy laws. Users are only now discovering this through news coverage.

Here’s the thing: Suno has told anyone who wants to read its website that something like this happens. Under California’s 2013 AB law — which requires AI companies to disclose their training practices — the company publicly I confess Its training data may include music that is “subject to intellectual property protection,” and the collection is included in tens of millions of publicly available music audio files. What the hack adds is privacy: the legal recording was opaque by design, while the leaked code was not.

The scope of AI music training was already clear before anyone hacked anything. In June 2026, Atlantic Four searchable databases published Documentation of the music used to train the AI ​​models – one with 12 million audio clips, another with 9 million audio clips, and two more with about 100,000 audio clips each. You can search for your favorite artist before the hacker hands over the source code to anyone.

The Recording Industry Association of America had claimed a 2025 amendment to its original version 2024 Lawsuit filed against Sono That the company was copying songs directly from YouTube — an accusation that Suno disputed under the fair use defense. The lawsuit seeks $150,000 for each incident of violation. The hacked source code confirms the RIAA’s central claim.

Udio, which was targeted in a parallel lawsuit filed by the same coalition of major brands, He settled with Warner Music in November 2025 and is now moving to a licensed platform. Suno’s case with Sony and UMG remains active in federal court; The company’s valuation is at $5.4 billion With about 100 million users on the platform.

Suno did not immediately respond to a request for comment Decryption.