Leak Reveals Suno Has Fed Thousands of Hours of Deezer, YouTube and Pond5 Data into Its AI

A hacker broke into the AI ​​music platform Suno and came out with a code that records, in detail, exactly where the company’s training came from.

The violation was was first reported by 404 Mediawhich reviewed the downloaded files. It confirms what the music industry has been saying in court since 2024.

The attacker allegedly used a piece of malware called the Shai-Hulud worm—named after the giant sand worms in Frank Herbert’s Dune. Suno, one of the largest AI music generators on the Internet, allows users to write a description and receive a full song in seconds; Creating this skill requires a large training set – a series of audio files used to teach the model how colors and styles sound.

The downloads contain cutting instructions and internal logs from 2023 and 2024, which provide a rare look at how the pipeline is assembled.

Damage to the dataset is standard. According to internal file comments reviewed by 404 MediaThe training library consisted of 113,879 hours of YouTube Music, 152,162 hours of YouTube music, 62,117 hours from the library library Pond5, 12,287 hours from Deezer, and 17,615 hours in the dataset labeled genius_hq, linked to the content collected through Genius. The code also listed plans to download nearly 1 million hours of podcast audio via an RSS feed.

A single internal file tracking YouTube Music downloads alone has uploaded 2,013,545 songs. That’s millions of tapes listened to over decades—and the passion wasn’t just music.

The hacker reportedly obtained records related to hundreds of thousands of customers, including email addresses, phone numbers, and information related to Stripe. Suno claims that personal information was compromised.

The company says it discovered the incident in November 2025 and called it “minor.” Suno concluded that disclosures involving the old code no longer apply and concluded that individual customer information is not required under privacy laws. Users are only realizing this now, through news stories.

Here’s the thing: Suno had already told anyone who wanted to read his website that things like this were happening. Under California’s AB 2013 law—which requires AI companies to disclose their training systems—the company publicly. he agreed that his studies would include “intellectually protected” music, and he cataloged millions of publicly available audio files. What the hack adds is standard: The official booking was unclear by design, and the downloaded code is not.

The development of AI music education was evident before anyone broke anything. In June 2026, Atlantic Ocean published four research databases recording music used to train AI models—one has 12 million tracks, another has 9 million, and two others have about 100,000 each. You can check your favorite artist before they give anyone else the code.

The Recording Industry Association of America said in 2025 its first changes 2024 case against Suno that the company rips music directly from YouTube – a charge that Suno denied in a fair defense. The suit sought $150,000 per accident. The stolen identity code complies with the RIAA’s requirements.

Udio, which is subject to similar charges filed by the same major corporation, settled with Warner Music in November 2025 and are now transitioning to an official platform. Suno’s lawsuit against Sony and UMG is still active in federal court; the value of the company is based on $5.4 billion with nearly 100 million users on the platform.

Suno did not immediately respond to a request for comment Decrypt.