The Suno hack revealed shocking levels of piracy: 113,000 hours of YouTube Music and data from millions of users.
As a result of a targeted attack on the infrastructure of the music AI service Suno, source code was leaked to the public, shedding light on the methods of collecting training data. A hacker under the pseudonym ellie.191, using the Shai-Hulud worm that spread through compromised npm packages, gained access to the company's systems.
According to my data, the malware stole employee credentials, allowing the attacker to exfiltrate not only the source code but also confidential information about hundreds of thousands of users: email addresses, phone numbers, and Stripe payment system data. Suno confirmed the breach, which was discovered back in November 2025, but insists the incident only affected outdated code and that full bank card numbers are not stored. However, the company has yet to publish a technical report, raising serious questions.
The Gold Mine of Pirated Content
The real shock came from files describing the model training process. The code revealed download logs showing that Suno actively pulled content from leading platforms without having licenses to do so. One file recorded the download of 2,013,545 music clips from YouTube Music totaling 113,879 hours. Additionally, a dataset labeled ytm_tagged included another 152,162 hours of annotated recordings.
The scale is impressive: 62,117 hours from Pond5, 12,287 hours from Deezer, 17,615 hours of Genius lyrics, as well as tens of thousands of hours from sheet music libraries and Freesound. Particularly noteworthy is the plan to download about 1 million hours of podcasts from 420,000 RSS feeds. To collect audio from YouTube, developers used Bright Data proxy services to mask their IP addresses.
Legal Consequences: Lawsuit Against Piracy
This leak comes amid fierce legal battles. In May 2026, Universal Music Group and Sony Music Entertainment demanded the addition of 61,026 recordings found in the training data to the lawsuit against Suno. The labels claim Suno violates the DMCA by bypassing YouTube's technical protection measures using YT-DL and YT-DLP tools. In my opinion, the leaked code is direct evidence of the factual side of the accusations: it confirms mass downloading from YouTube and the use of proxies.
It is worth noting that in November 2025, Warner Music Group took a different path by signing a licensing agreement with Suno. However, for Universal and Sony, this incident is a powerful trump card. The leaked code not only compromises Suno but also calls into question the legitimacy of the entire training model for generative AI services. My conclusion: if the court finds these actions to be copyright infringement, it will set a dangerous precedent that will hit the entire AI content generation industry, forcing companies either to pay huge licensing fees or completely rethink their technologies.