- A Hacker using the Shai-Hulud worm breached AI music platform Suno and leaked source code detailing training data scraped from 113,879 hours of YouTube Music, 62,117 hours of Pond5, and 12,287 hours of Deezer, among other sources.
- The intrusion also accessed customer emails, phone numbers, and Stripe payment data for hundreds of thousands of users, according to the hacker; Suno disputes that sensitive personal information was compromised.
- Leaked internal files corroborate allegations from the Recording Industry Association of America (RIAA) in an ongoing 2024 lawsuit that Suno ripped songs directly from YouTube, a claim the company contests under fair use.
A hacker broke into AI music platform Suno and walked out with source code that documents exactly where its training data came from. The breach was first reported by 404 Media, which reviewed leaked files confirming what the music industry had alleged in court since 2024.
The intruder used Malware called the Shai-Hulud worm—named after the sandworms in Frank Herbert’s Dune. Internal logs from 2023 and 2024 show the dataset included 113,879 hours of YouTube Music, 62,117 hours from stock library Pond5, 12,287 hours from Deezer, and 17,615 hours from a dataset labeled genius_hq tied to Genius lyrics. The code also documented plans to download roughly 1 million hours of podcast audio via RSS feeds.
One internal file tracking YouTube Music ingestion alone logged 2,013,545 music clips. The hacker claimed access to records associated with hundreds of thousands of customers, including emails, phone numbers, and Stripe-related information. Suno says it identified the incident in November 2025 and called it “limited,” concluding that individual customer notifications weren’t required under applicable privacy laws.
Suno had already acknowledged under California’s AB 2013 law that its training data may include music “subject to intellectual property protection,” as publicly disclosed on its help site. The RIAA alleged in a 2025 amendment to its 2024 lawsuit that Suno was ripping songs from YouTube, a claim the company contested under fair use. The RIAA sought $150,000 per infringement incident.
In June 2026, The Atlantic published four searchable databases documenting music used for AI training—one containing 12 million tracks. Competitor Udio settled with Warner Music in November 2025 and is transitioning to a licensed platform. Suno‘s valuation sits at $5.4 billion with around 100 million users, per its Series D announcement. Suno did not immediately respond to a request for comment.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
