Suno Hack Exposes Source Code Logs, 2 Million YouTube Tracks Scraped

Key takeaway: AI music generator Suno was hacked, and its leaked source code contained per-source collection logs, including 2,013,545 YouTube Music tracks, 404 Media reports. Far from the "openly available music" the company described, the code shows industrial-scale scraping with source labels attached, and it lands squarely on the core question of the ongoing record label lawsuits.

AI music generator Suno was hacked and its source code leaked, and inside that code were records of what music was collected, from where, and how much, broken down by source, 404 Media reported on July 15. The breach reportedly also exposed personal information for hundreds of thousands of customers along with Stripe payment data. Here is why this leak reads less like a routine security incident and more like a turning point in the fight over AI and copyright, and what creators should take away from it.

The Numbers Written in the Code

The leaked code appears to date from around 2023 to 2024, and it tallied the collected data source by source, down to the hour. According to the report, YouTube Music alone accounts for 2,013,545 tracks, or 113,879 hours of audio. Played back to back without a break, that is 13 years of music.

The per-source logs

There were also traces of podcast collection via RSS feeds. In other words, the collection went beyond songs to human voices themselves.

The gap between "openly available" and the logs

Suno has long described its training data only as "essentially all music files of reasonable quality that are accessible on the open internet." Inside the code, that same data carried source labels, line by line. This is close to a first: the gap between "it's publicly accessible" and "we're allowed to take it" exposed by a company's own internal records.

A Leak That Hits the Lawsuit's Core Question

Suno has been in litigation with major record labels including Sony and Universal since 2024. During the case, the labels added the claim that Suno ripped songs directly from YouTube (stream ripping), and 404 Media wrote that the hacked data "confirms" that allegation.

That detail matters. Pulling audio out of YouTube is treated as a step beyond simply "training on copyrighted music," because what goes on trial is the method used to obtain the data: circumventing a platform's terms and technical protections. Warner Music, meanwhile, chose a license deal with Suno instead of continuing to fight, so even the labels are split on how to respond.

Where the Courts Split: Not "Did It Learn" but "How Was It Obtained"

US court rulings on AI training and copyright have not settled into one direction. Two decisions from last year show the fault line.

Same training, different conclusions

In lawsuits over AI companies training on books, one court (the Anthropic case) held that training on lawfully purchased books is fair use, while treating pirated collections as a separate problem, showing that the outcome can hinge on how the data was acquired. Around the same time, another court (the Meta case) recognized fair use more broadly.

So the center of gravity moved

With the rulings split, the fight has been shifting from "did the AI learn from it" to "how was the data obtained". Even if training itself is allowed, unauthorized copying or circumvention on the way to the data can still carry liability. What this hack exposed is precisely that acquisition trail, which is why it is expected to weigh on the ongoing cases.

What Creators Can Actually Do

For creators, the takeaway is clear: content uploaded to YouTube is already being treated as raw material for AI training. There is currently no way to check whether your voice, your performance, or your podcast sits in some company's training list, and as this case shows, it tends to surface only through a hack.

The setting worth checking on your channel

YouTube offers a channel-level setting for third-party AI training permission, and the default is set to not allow. It is worth checking once in YouTube Studio's channel settings. But keep expectations straight: the setting only matters to companies that ask permission. The uncomfortable lesson of this case is that unauthorized scraping happens regardless of it.

If you use AI music in your videos

There is also a flip side for anyone using AI music as background tracks. If a service's training data provenance is unresolved, the status of its output can shift with a court ruling. For videos with revenue on the line, music with clear licensing remains the safer choice, and if you do use AI tracks, keep a record of which service generated them and when.

FAQ

Can I check whether Suno trained on my music or voice?

Not currently. AI companies do not publish their training data lists, and even this time, the scale only came to light through hacked internal records.

Is training AI on copyrighted music illegal?

The courts are still split. The trend, though, is to weigh "how the data was obtained" more than "whether training happened," which makes unauthorized collection the heavier liability.

Can I stop my YouTube content from being used for AI training?

YouTube Studio has a channel setting for third-party AI training, and the default is not to allow it. But it only binds companies that ask permission; it does not stop unauthorized scraping.

Is it safe to use Suno music as background music in my videos?

Under the service's terms, paid plans allow commercial use. But with training data lawsuits still in progress, for revenue-generating videos it is worth pairing it with clearly licensed music and watching how the cases resolve.

What customer data leaked in this hack?

According to the report, personal information for hundreds of thousands of customers and Stripe-related payment data leaked along with the source code. If you have a Suno account, change your password, and update any other service where you reuse it.

Source: 404 Media