Suno trained AI on millions of songs scraped from YouTube, Genius, Deezer

Suno's position in ongoing litigation has been strengthened by the leaked data, which transforms the RIAA's allegations from speculation into documented evidence. The hacker's disclosure of source code and scraping instructions directly supports the RIAA's claim that Suno intentionally circumvented YouTube's copyright protections—a violation distinct from the fair use defense Suno has been mounting. Suno has consistently avoided public disclosure of its training data sources, stating only that it trained on "publicly available music files and related metadata accessible on third-party websites on the open Internet." The leaked files reveal not just what was scraped, but how: the deliberate search for a cappella versions to isolate vocals, the use of third-party scraping services like Bright Data, and the systematic scale (over 2 million YouTube Music clips alone) suggest an industrial-grade data collection operation that goes well beyond passive use of public content.

The security incident itself, discovered in November 2025, exposed customer payment and contact information alongside the training data—a compounding embarrassment for a company arguing it should be trusted with copyrighted content. Suno's assertion that "no sensitive personal information was compromised" contradicts the hacker's apparent access to email, phone numbers, and Stripe details, and the company's refusal to notify customers invokes a narrow reading of privacy law that may not hold up if regulators or affected users challenge it.