Photo Credit: 404 Media

A new hack sheds some light on how Suno pulled from streaming services and websites like YouTube Music, Deezer, and Genius to train its product.

As Suno brawls with the majors over copyright infringement, a hacker who breached the company’s data shared information with 404 Media about Suno’s training libraries. The data reveals just how many hours of copyrighted songs and lyrics were scraped online to train the company’s AI models—including “113,879 hours” of YouTube Music, “17,615 hours” of Genius, and “12,287 hours” of Deezer.

While it’s no secret that Suno’s AI music generator relied on scraping millions of songs online, the hack sheds some light on just how the company went about it, and from what sources it pulled. Even more egregious, the hack revealed Suno’s customer list, which included emails, phone numbers, and even Stripe payment details.

According to Suno, the hack was “quickly contained” after the company learned about it in November. A spokesperson claimed that it primarily exposed “outdated source code that is no longer in use at Suno.” Further, the company asserted that no sensitive user information was compromised, as Suno does not retain “full credit card numbers.” Due to the “limited breach,” Suno did not feel obligated to notify its users.

Suno has acknowledged both on its website and in legal filings that its product was trained on “essentially all music files of reasonable quality that are accessible on the open internet.” However, it continues to claim that such use is protected under fair use law and that it has guardrails in place to prevent users from producing songs similar to those scraped in its training.

“Our goal has always been to help people create original new music, not replicate someone else’s. That’s why we build our models around what we call ‘original creation by design,’” said a Suno spokesperson. “For example, we intentionally do not use artist names as a category of training metadata because we want our models to help people create brand new songs, not music that replicates other artists’ existing work. It’s also why we built Suno with detection filters that block or prevent a user from using specific artist, song, or album names as prompts, and prevent users from uploading lyrics or sound recordings that match existing works.”

Regardless, the hack provides a rare window into how AI music generators train their products—a process that has led to numerous copyright infringement lawsuits against the company (and others) by record labels including Universal Music Group and Sony Music Entertainment, as well as the Recording Industry Association of America.

Warner Music Group settled its lawsuit with Suno last year, and the two companies are now working on developing a new model of the music generator that has presumably been trained on copyrighted Warner assets.

Meanwhile, the rapidly growing Suno is seemingly unfazed as it prepares for a major initial public offering, with a new job post advertising its need for a Director of Accounting.