HACKER ACCESSES SUNO SOURCE CODE REVEALING AI MUSIC TRAINING DATA

A hacker using the moniker ellie.191 accessed source code belonging to Suno, an artificial intelligence music generation company, through a supply chain attack in November 2025. The breach exposed documentation detailing how Suno trained its AI systems, according to reports. Screenshots and files shared with a technology publication confirm that Suno sourced training data from YouTube Music, Deezer, Genius and Pond5, a stock music library owned by Shutterstock. The hacker also obtained customer records and payment information held by Suno's payment processor, Stripe.

The accessed files indicate the scale of data collection across multiple platforms. One folder labelled "youtube_music" contained over 2 million music clips at the time of last access. Additional files showed Suno had accumulated more than 17,000 hours of music from Genius HQ, over 12,000 hours from Deezer and more than 62,000 hours from Pond5. Suno stated that the exposed source code was "outdated" and no longer in active use within the company. The company also asserted that no sensitive personal information was compromised and concluded it held no obligation to notify individual users under current privacy laws.

The incident provides documented evidence supporting long-standing claims by musicians, record labels and streaming services that AI music generators train on copyrighted material without permission. A Suno spokesperson told CNET the company had immediately investigated the breach following its discovery. The disclosure occurs as generative AI music tools gain wider adoption on social media platforms, raising questions about how such systems obtain and use training data from established music sources.