A hacker broke into Suno's database and found receipts.
Internal files revealed by the breach show Suno scraped more than two million clips from YouTube Music, plus 113,879 hours labeled "youtube_music," 152,162 hours of tagged YouTube material, 17,615 hours from Genius, and 12,287 hours from Deezer — figures that add up to well over a decade of audio. Code in the breach also suggests Suno routed scraping traffic through third-party proxies, and used PodcastIndex to identify hundreds of thousands of podcasts for potential ingestion. Suno disclosed the breach itself in a statement, saying it detected "a limited security incident" in November 2025 that was "quickly contained" and involved "outdated source code that is no longer in use."
The significance here is less the hack than the specificity it provides. Suno had already admitted in 2024 court filings to training on "essentially all music files of reasonable quality that are accessible on the open internet," but internal dataset labels naming exact sources and hour counts are harder to wave away than a general disclosure. The Recording Industry Association of America has accused Suno of unlawfully scraping YouTube tracks; these files suggest that accusation was directionally correct. Suno's spokesperson pushed back, telling 404 Media that outputs are "significantly different from original works" and that the company has invested in safeguards against impersonation.
The fair use argument has found some traction in US courts — judges ruled in favor of Anthropic and Meta on similar training-data claims last year — but Suno's case involves alleged proxy-routed scraping at industrial scale, which may test those precedents further.