Suno has long acknowledged that its AI-powered music generator relied on mining millions of songs available on the Internet, but a new hack reveals how the company turned to streaming services and websites like YouTube Music, Deezer, and Genius to push its product, all while user information remained vulnerable.

A report published in 404 Media on Wednesday, based on data a hacker provided to the outlet, showed that instructions in the company’s source code allowed it to extract files from “genius_hq, youtube_music, freesound, jamendo, imp, deezer,” with stock music libraries Freesound, Jamendo and the International Music Score Library Project, among other sources, removed. The instructions demanded that anything other than music be filtered. According to the report, the hacker also had access to Suno’s customer list, which included emails, phone numbers, and Stripe payment details.

Representatives for Deezer, YouTube Music, Genius and the removed archive libraries did not respond to immediate requests for comment.

A Suno spokesperson said the hack was “quickly contained” after the company became aware of it in November 2025 and that it primarily exposed “obsolete source code that is no longer used in Suno.” The spokesperson said that no sensitive user information was compromised, as the company does not retain full credit card numbers, and that due to the limited breach, it did not feel obligated to notify its user base.

“As we have stated in public filings and disclosures, Suno’s AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open Internet,” the spokesperson said.

One file focused on YouTube Music noted that it contained “2,013,545 music clips” at the time of its last update, while another file’s comments on the Suno data sets included “113,879 hours of youtube_music,” “17,615 hours of genius_hq,” “410 hours of free sound,” “19,514 hours of imslp,” “3,726 hours of jamendo,” “62,117 hours of pond5_music”, “12,287 hours of deezer”, “152,162 hours of ytm_tagged” and “103 hours of musescore_lyrics”, according to the 404 Media report.

The hack offers a rare glimpse into how AI music generators train their products, a process that has fueled several copyright infringement lawsuits against the company by record labels, including Universal Music Group and Sony Music Entertainment, and the Recording Industry Association of America, which represents the recording industry, while earning derision from several artists. (Warner Music Group settled its lawsuit with Suno last year and the two are currently developing a new model of music generator.)

Suno has acknowledged both in filings and on its website that its product was trained on “essentially all music files of reasonable quality that are accessible on the open Internet, respecting paywalls, password protections, and the like, combined with similarly available text descriptions,” although it has claimed that such use is protected by fair use law and that it has introduced to prevent its users from producing songs similar to those extracted during training.

“Our goal has always been to help people create new original music, not replicate someone else’s. That’s why we build our models around what we call ‘Original Creation, by Design,'” the spokesperson said in a statement. “For example, we intentionally don’t use artist names as a training metadata category because we want our models to help people create new songs, not music that replicates other artists’ existing work. It’s also why we built Suno with detection filters that block or prevent a user from using specific artist, song, or album names as prompts, and prevent users from uploading lyrics or sound recordings that match existing work.”