AI music platform Suno is facing renewed scrutiny after a security breach reportedly exposed internal files suggesting the company trained its music generation models using millions of songs and lyrics scraped from platforms including YouTube, Deezer and Genius.
According to a report from Pitchfork, citing documents obtained by 404 Media, the hack occurred in late 2025 but only became public this week. The leaked material allegedly includes source code and internal documentation detailing datasets compiled from YouTube Music, Deezer, Genius, stock music libraries and other online sources. The revelations add further weight to ongoing copyright disputes surrounding AI music training and the use of copyrighted material without permission.
The leak arrives as Suno continues to defend itself against lawsuits from major record labels over claims that it unlawfully used copyrighted recordings to train its AI models. While the company has previously acknowledged training on publicly available music files and argued that the practice falls under fair use, the leaked files reportedly provide one of the clearest looks yet at the specific sources and scale of its data collection. Internal comments referenced in the documents suggest the platform ingested millions of YouTube Music clips alongside thousands of hours of material from other music databases.
In a statement shared with Pitchfork, a Suno spokesperson said the incident was a “limited security incident” discovered in November 2025 that was quickly contained. The company said the breach primarily exposed outdated source code that is no longer in use and maintained that no sensitive personal information or full customer credit card numbers were compromised. Suno also reiterated that its goal is to generate original music rather than replicate existing artists’ work, pointing to safeguards designed to prevent impersonation and misuse.
