The internal device of one of the largest services for the generation of music was revealed not in court, but after the hack. The hacker’s files indicate that Suno massively collected songs, lyrics and podcasts from YouTube Music, Deeze, Genius and other platforms to train their models.
The hacker, under the pseudonym, eline, sent to the publication 404 Media the source code of the Suno, presumably related to 2023 and 2024. The files have better instructions on how to download materials, and information about the sizes of individual data sets. Only from YouTube Music, the service, judging by the code, received more than 2 million music fragments.
The sources also include the Pond5, Jamendo, Freesound libraries, the International Musical Activity and MusesScore Library. One of the files lists hundreds of thousands of hours of audio. The largest set included more than 152 thousand hours of materials from YouTube Music with marking, another 114 thousand hours fell on another collection from the same site. From the Pond5 developers collected about 62 thousand hours of music, from Deezer - more than 12 thousand.
Individual programs were looking for versions of songs on YouTube without instrumental accompaniment to highlight vocals. To massively upload materials, Suno, judging by the code, used proxy servers of Bright Data. Another tool helped to find 420 thousand podcasts and prepare for download about 1 million hours of records.
The publication confirms some of the charges that were previously put forward by the American Recording Association. Representatives of the music industry claimed that Suno copied copyrighted compositions directly from YouTube and bypassed the technical limitations of the platform.
Suno itself has already admitted that she trained models on tens of millions of Internet records. The company believes that this is how materials are in good faith, although copyright holders challenge such an approach in the courts.
The hacker also stated that he received information about hundreds of thousands of Suno customers, including email addresses, phone numbers and individual data related to payments via Stripe. Several users confirmed 404 Media that they registered with the numbers indicated in the leak and did not receive notifications about the incident.
Suno said it found a limited incident in November 2025 and quickly stopped it. According to the company, the attacker received a predominantly outdated source code, which is no longer used. Suno representatives deny that confidential personal data has leaked, and emphasizes that the service does not have access to full number of bank cards.
ellie.191 claims to have entered Suno infrastructure through an account of one of the employees infected with the Shai-Hulud worm. The malware campaign allowed to steal access keys to GitHub and cloud services. Hacker said he did not pursue a specific target and hacked the company out of the usual interest.
Suno insists that it seeks to create new music rather than copying existing works. The company claims that it does not add the names of the performers to the marking of training data and introduces restrictions against imitation of someone else's style. The leaked code, however, shows how large a large array of alien records did the service to learn how to create their own compositions.
The hacker, under the pseudonym, eline, sent to the publication 404 Media the source code of the Suno, presumably related to 2023 and 2024. The files have better instructions on how to download materials, and information about the sizes of individual data sets. Only from YouTube Music, the service, judging by the code, received more than 2 million music fragments.
The sources also include the Pond5, Jamendo, Freesound libraries, the International Musical Activity and MusesScore Library. One of the files lists hundreds of thousands of hours of audio. The largest set included more than 152 thousand hours of materials from YouTube Music with marking, another 114 thousand hours fell on another collection from the same site. From the Pond5 developers collected about 62 thousand hours of music, from Deezer - more than 12 thousand.
Individual programs were looking for versions of songs on YouTube without instrumental accompaniment to highlight vocals. To massively upload materials, Suno, judging by the code, used proxy servers of Bright Data. Another tool helped to find 420 thousand podcasts and prepare for download about 1 million hours of records.
The publication confirms some of the charges that were previously put forward by the American Recording Association. Representatives of the music industry claimed that Suno copied copyrighted compositions directly from YouTube and bypassed the technical limitations of the platform.
Suno itself has already admitted that she trained models on tens of millions of Internet records. The company believes that this is how materials are in good faith, although copyright holders challenge such an approach in the courts.
The hacker also stated that he received information about hundreds of thousands of Suno customers, including email addresses, phone numbers and individual data related to payments via Stripe. Several users confirmed 404 Media that they registered with the numbers indicated in the leak and did not receive notifications about the incident.
Suno said it found a limited incident in November 2025 and quickly stopped it. According to the company, the attacker received a predominantly outdated source code, which is no longer used. Suno representatives deny that confidential personal data has leaked, and emphasizes that the service does not have access to full number of bank cards.
ellie.191 claims to have entered Suno infrastructure through an account of one of the employees infected with the Shai-Hulud worm. The malware campaign allowed to steal access keys to GitHub and cloud services. Hacker said he did not pursue a specific target and hacked the company out of the usual interest.
Suno insists that it seeks to create new music rather than copying existing works. The company claims that it does not add the names of the performers to the marking of training data and introduces restrictions against imitation of someone else's style. The leaked code, however, shows how large a large array of alien records did the service to learn how to create their own compositions.
