AI Music Startup Suno Hacked: Its Huge Training Archive Has Been Exposed
Originally published in Turkish. Read the original →
Suno, the AI company that revolutionized music production, was hit by a major cyberattack. Leaked documents revealed the massive archive of millions of songs and the data sources the company used to train its AI model. The documents, which show data was pulled without permission from many platforms led by YouTube Music, could tip the balance in copyright lawsuits.
While AI-powered music generation platforms boost creativity, they have also started one of the biggest legal debates in history over copyright. More than the quality of the music produced, the question of which sources the models were trained on is pitting both artists and major record labels against these companies. Suno, one of the startups at the center of these debates, is now in the news because of a technological leak.
Documents leaked online after a cyberattack on Suno's systems revealed in full detail the huge data pool the platform used to train its AI model.
Sources Totaling Millions of Songs Exposed
According to details shared by Gizmodo, the attackers leaked critical technical data about Suno's training infrastructure. Examining the documents made it clear that data had been scraped from many different platforms on the internet to train the AI.
The main platforms in the data pool are:
* YouTube Music * Deezer * Genius (for lyrics and metadata analysis) * Jamendo and Pond5 * Freesound (for sound effects) * IMSLP (classical music scores and recordings)
The most striking detail of the leak emerged in the YouTube Music data. The documents show that Suno integrated about 2 million music videos from YouTube Music into its system and processed more than 100,000 hours of audio from this source alone. Including the other platforms, it appears that tens of thousands of hours of copyrighted music and audio files were added to Suno's database.
Suno Acknowledged the Security Breach
Suno officials confirmed the cyberattack in a statement responding to the leak claims. However, according to the company, the breach actually happened in 2025. The company said a large part of the leaked source code and technical documents belonged to old versions that are no longer in use, and that the necessary security patches had been applied after the incident.
Although the company says users' credit card data is safe, the possibility that the attackers may have accessed some sensitive data, such as email addresses, phone numbers and information about users' payment infrastructure, is increasing concerns.
The Cards Are Being Reshuffled in the Copyright Lawsuits
Suno is already in a legal battle with the world's biggest record labels. In its defense, the company admitted that its models were trained on data found on the open internet but argued that this should be considered "fair use".
The leaked technical documents could undermine this defense, however. For the first time, concrete records have come to light showing which commercial music platforms Suno collected data from, in what quantities and with which technical methods. Lawyers expect that these detailed lists and technical diagrams could be presented to the court by the record labels as very strong evidence in the ongoing copyright cases.
As legal pressure on AI companies grows, this security vulnerability at Suno looks set to keep the debates over AI model transparency and data collection ethics on the agenda for a long time.
