Key facts
- A hacker breached AI music platform Suno using the Shai-Hulud worm.
- Leaked source code details Suno's training data, including over 113,000 hours of YouTube Music.
- The training data also comprised 62,117 hours from Pond5 and 12,287 hours from Deezer.
- The hacker claims to have accessed hundreds of thousands of customer records, including emails and phone numbers.
- Suno stated the breach involved limited, outdated source code and did not necessitate individual customer notifications.
A hacker, reportedly using malware named the Shai-Hulud worm, breached AI music platform Suno and leaked source code detailing its extensive data scraping practices. The leaked files, reviewed by 404 Media, reveal that Suno's training dataset included over 113,000 hours of YouTube Music, 62,000 hours from stock music library Pond5, and 12,000 hours from Deezer, among other sources. Internal logs also documented plans to download approximately 1 million hours of podcast audio.
The hacker also claimed to have accessed sensitive customer information, including emails, phone numbers, and Stripe payment data, affecting hundreds of thousands of users. However, Suno has disputed the extent of this compromise, stating that the incident, identified in November 2025, was limited and primarily involved outdated source code no longer in use. The company concluded that individual customer notifications were not required under applicable privacy laws.
This revelation corroborates long-standing allegations from the music industry. The Recording Industry Association of America (RIAA) had previously accused Suno of directly ripping songs from YouTube in a lawsuit amendment. Suno had contested these claims under a fair use defense. Notably, Suno had already publicly acknowledged on its website, in accordance with California's AB 2013 law, that its training data might include music protected by intellectual property rights, referring to tens of millions of publicly available audio files. The leaked code provides specific details previously absent from such disclosures.
Suno's valuation stands at $5.4 billion with around 100 million users. In a parallel case, AI music platform Udio settled with Warner Music in November 2025 and is transitioning to a licensed model. Suno's legal disputes with Sony and UMG remain active.