Suno's source code leak reveals extensive audio downloads and user data exposure following a hacker breach.
The AI music service Suno has been compromised, exposing its source code and revealing how it downloads audio from various platforms for model training. An investigation by 404 Media uncovered that a hacker, known as ellie.191, exploited a Shai-Hulud worm that infected an employee's computer, allowing access to the company’s systems.
The malware infiltrated through compromised npm packages, pilfering sensitive credentials and access keys. While the hacker's exact role in the breach is not fully understood, they claimed to have accessed personal data of hundreds of thousands of users, including email addresses and phone numbers. Some records were verified by journalists, though the full scale of the leak remains unconfirmed.
Suno acknowledged the breach, which was identified in November 2025, asserting that it does not store complete credit card numbers. A company representative stated, “The incident was quickly contained. It primarily affected outdated code. No confidential personal data was compromised.” However, Suno has not released a technical report to clarify the extent of the data affected.
Details of the Exposed Data
The leaked code indicated extensive downloads of audio content, including over 2 million music videos from YouTube Music, totaling nearly 114,000 hours. Additional data included 62,117 hours from Pond5, and 12,287 hours from Deezer, among others. A plan to download around 1 million hours of podcasts from 420,000 RSS feeds was also found, but it is unclear if this was executed or included in the training data.
To facilitate audio collection from YouTube, Suno reportedly utilized proxy services from Bright Data, which allowed for requests to be routed through third-party IP addresses.
‼️ BREAKING: A hacker breached AI music company Suno using the Shai-Hulud worm and released source code showing how its training set was built: 113,879 hours of YouTube Music, 62,117 hours of Pond5, 12,287 hours of Deezer, and more.
— International Cyber Digest (@IntCyberDigest) July 16, 2026
Suno developers previously disclosed that their models are trained on tens of millions of publicly available audio files, some of which may infringe on copyright. This data collection began in spring 2023.
Legal Implications of the Data Leak
The data breach comes amid ongoing legal challenges from major labels. On May 21, Universal Music Group and Sony Music Entertainment sought to add over 61,000 recordings to their lawsuit against Suno, claiming these were identified in the training data through audio fingerprinting technology. The labels argue that the use of their recordings is unauthorized, while Suno maintains that it falls under fair use.
The labels have matched millions of recordings to their catalog, with the current lawsuit representing only a fraction of their claims. The court has yet to rule on this expansion. Additionally, the labels have raised concerns about Suno's methods of obtaining audio files, alleging violations of the DMCA due to the use of tools like YT-DL to bypass YouTube's protections.
While the leaked code may bolster the labels' claims regarding audio downloads, it does not definitively prove any specific DMCA violations. In a separate development, Warner Music Group settled its dispute with Suno in November 2025, resulting in a licensing agreement and the acquisition of the concert discovery service Songkick.
In March 2026, Suno released model version 5.5, which includes features for personalized AI model creation and music generation.
