Hack exposes Suno's music scraping playbook

The curtain on how generative AI tools actually get built just got ripped off by a hacker.

For months, Suno has insisted in court that it merely learns from publicly available music on the open web under fair use. Now, internal source code leaked to 404 Media reveals the exact receipt of where its songs came from, and it is every major platform the record industry suspected.

A 380,000-hour grab bag of scraped audio

A hacker going by the handle ellie.191 breached Suno in November through a supply chain attack on an employee credential, walking away with internal repositories from 2023 and 2024.

Those files detail scraping pipelines built to harvest millions of tracks and lyrics. Targets included YouTube Music, Deezer, Genius, IMSLP, MuseScore, Jamendo, Pond5, and Freesound. One file alone recorded over 2.01 million ingests from YouTube Music.

Internal logs show datasets with 113,879 hours of YouTube Music, another 152,162 hours of tagged YouTube audio, 62,117 hours from Pond5, and thousands of hours from Deezer and Genius. In total, the haul represents over 380,000 hours of audio, alongside nearly one million hours of podcasts pulled via PodcastIndex.

The technical details are especially damning. Leaked code indicates Suno used proxy vendor Bright Data to scrape YouTube and actively hunted for a cappella tracks to isolate vocal stems.

On top of that, the intruder accessed records for hundreds of thousands of customers, including emails, phone numbers, and partial Stripe card records. Suno confirmed a security incident from November 2025 occurred, but claimed it was quickly contained, involved legacy code, and did not meet legal thresholds requiring user notification.

Why it matters

If you pay for Suno or use it in creative workflows, this is a wake-up call on two fronts. First, your personal details were exposed in a breach the company decided not to tell you about. Second, the legal ground under Suno just turned into quicksand, making any commercial reliance on its output look increasingly risky.

For the broader AI ecosystem, this leak pierces the corporate fog of fair use. Major models routinely argue they simply read the public internet, but deliberately using proxy tools to bypass platform barriers and rip streams directly implicates the DMCA anti-circumvention provisions. That is a far harder charge to dodge than broad copyright ambiguity.

We think this revelation completely dismantles Suno's public posture. Quietly pulling millions of tracks behind commercial proxies while lecturing the industry on fair use looks reckless in hindsight. With the major record labels already circling, these leaked scraping scripts give the plaintiffs the smoking gun they needed to blow open the trial.