ArtistDirect News
Suno AI Scraped Over Two Million Songs in 2023-24 Hack, Raising Copyright and Fair-Use Questions
In November 2025, a supply‑chain breach revealed Suno Inc.’s hidden recipe for harvesting music from the web. Hackers infiltrated the company’s source‑code repository and uncovered a detailed set of instructions that showed the AI‑music platform had systematically scraped millions of audio clips and lyrics from major streaming and stock‑media services between 2023 and 2024.
The leaked files document that Suno logged 2,013,545 individual clips from YouTube Music alone, amassing 113,879 hours of audio from that service. The platform also harvested 62,117 hours from Pond5, 17,615 hours from Genius, and 12,287 hours from Deezer. In addition, the code contains directives for collecting content from Jamendo, Freesound, the International Music Score Library Project, and podcast feeds via PodcastIndex. One set of instructions outlined a pipeline that used proxy services to bypass YouTube’s streaming controls and targeted a cappella recordings for vocal‑only audio, while another aimed to gather roughly one million hours of podcast material.
Record‑label plaintiffs, represented by the Recording Industry Association of America (RIAA), argue that Suno’s method constituted “stream ripping”—capturing streamed media as downloadable files while circumventing the technological measures that prevent such copying. The RIAA’s lawsuit, filed in Boston federal court in June 2024 on behalf of Sony, Universal, and Warner, seeks statutory damages for the alleged infringement.
Suno has replied that the exposed code was outdated and no longer in use at the time of the hack. The company maintains that its models were trained on publicly accessible internet files and that no sensitive customer data was compromised during the November 2025 incident. Suno also denies that the hacked files contain proof of personal data breaches, although the hacker alias ellie.191 reportedly accessed customer information for hundreds of thousands of users, including contact details and data held by the payment processor Stripe.
The legal dispute escalated after Suno and Warner Music Group settled their lawsuit on November 25 2025. The settlement created a partnership that allows Suno to develop licensed AI models using artists’ names, images, likenesses, voices, and compositions under opt‑in agreements. The agreement also stipulates that future models will compensate participating artists, a move Suno says will address the compensation concerns that have driven the litigation.
Suno’s financial footing has strengthened since the hack. In June 2026, the company raised more than $400 million in a funding round that valued it at $5.4 billion. The company plans to roll out its first licensed music model in the months after that funding, though it has not yet released a public version.
Industry observers note that the hack provides concrete evidence of the scale of data Suno may have used for training, a factor that courts will likely consider when evaluating the company’s fair‑use defense. While Suno argues that training an AI model and generating new output does not substitute for the original recordings, the RIAA’s claim that Suno’s methods violated anti‑circumvention provisions introduces a separate legal issue.
Musician Kenneth Blum, known as Kenny Beats, publicly criticized the alleged scraping, stating that it undermines the work of independent artists. His comments highlight the broader concern among creators that AI training data may be sourced from copyrighted works without permission.
The hack and its fallout underscore the growing tension between AI‑driven music creation and existing copyright frameworks. As Suno and other AI platforms continue to develop models that rely on large datasets, the industry faces a critical question: whether the use of copyrighted material for training can be justified under fair use, or whether it constitutes infringement that requires licensing and compensation.
At present, the courts have not ruled on the validity of the RIAA’s stream‑ripping allegations. The outcome of the ongoing litigation and the implementation of the Warner partnership will likely shape how AI music generators operate in the United States and beyond.
The situation remains fluid, with Suno’s partnership with Warner and its post‑funding rollout under scrutiny. The industry will watch how the legal and commercial developments resolve the balance between innovation and artists’ rights.
The leaked files document that Suno logged 2,013,545 individual clips from YouTube Music alone, amassing 113,879 hours of audio from that service. The platform also harvested 62,117 hours from Pond5, 17,615 hours from Genius, and 12,287 hours from Deezer. In addition, the code contains directives for collecting content from Jamendo, Freesound, the International Music Score Library Project, and podcast feeds via PodcastIndex. One set of instructions outlined a pipeline that used proxy services to bypass YouTube’s streaming controls and targeted a cappella recordings for vocal‑only audio, while another aimed to gather roughly one million hours of podcast material.
Record‑label plaintiffs, represented by the Recording Industry Association of America (RIAA), argue that Suno’s method constituted “stream ripping”—capturing streamed media as downloadable files while circumventing the technological measures that prevent such copying. The RIAA’s lawsuit, filed in Boston federal court in June 2024 on behalf of Sony, Universal, and Warner, seeks statutory damages for the alleged infringement.
Suno has replied that the exposed code was outdated and no longer in use at the time of the hack. The company maintains that its models were trained on publicly accessible internet files and that no sensitive customer data was compromised during the November 2025 incident. Suno also denies that the hacked files contain proof of personal data breaches, although the hacker alias ellie.191 reportedly accessed customer information for hundreds of thousands of users, including contact details and data held by the payment processor Stripe.
The legal dispute escalated after Suno and Warner Music Group settled their lawsuit on November 25 2025. The settlement created a partnership that allows Suno to develop licensed AI models using artists’ names, images, likenesses, voices, and compositions under opt‑in agreements. The agreement also stipulates that future models will compensate participating artists, a move Suno says will address the compensation concerns that have driven the litigation.
Suno’s financial footing has strengthened since the hack. In June 2026, the company raised more than $400 million in a funding round that valued it at $5.4 billion. The company plans to roll out its first licensed music model in the months after that funding, though it has not yet released a public version.
Industry observers note that the hack provides concrete evidence of the scale of data Suno may have used for training, a factor that courts will likely consider when evaluating the company’s fair‑use defense. While Suno argues that training an AI model and generating new output does not substitute for the original recordings, the RIAA’s claim that Suno’s methods violated anti‑circumvention provisions introduces a separate legal issue.
Musician Kenneth Blum, known as Kenny Beats, publicly criticized the alleged scraping, stating that it undermines the work of independent artists. His comments highlight the broader concern among creators that AI training data may be sourced from copyrighted works without permission.
The hack and its fallout underscore the growing tension between AI‑driven music creation and existing copyright frameworks. As Suno and other AI platforms continue to develop models that rely on large datasets, the industry faces a critical question: whether the use of copyrighted material for training can be justified under fair use, or whether it constitutes infringement that requires licensing and compensation.
At present, the courts have not ruled on the validity of the RIAA’s stream‑ripping allegations. The outcome of the ongoing litigation and the implementation of the Warner partnership will likely shape how AI music generators operate in the United States and beyond.
The situation remains fluid, with Suno’s partnership with Warner and its post‑funding rollout under scrutiny. The industry will watch how the legal and commercial developments resolve the balance between innovation and artists’ rights.