How a Hack Exposed Suno’s Secret: Millions of Songs Scraped from YouTube, Deezer, and Genius
A hacking incident has revealed that AI music generator Suno scraped millions of songs and lyrics from YouTube Music, Deezer, and Genius to train its models, despite having avoided disclosing its training data sources. The exposure intensifies ongoing RIAA litigation and reignites fundamental questions about fair use, AI training data transparency, and the rights of musicians whose work powers commercial AI products.
When a Hack Becomes a Disclosure: Suno’s Training Data Exposed
For months, Suno — one of the most capable AI music generators on the market — kept the contents of its training datasets tightly under wraps. That opacity has now been shattered, not by a regulatory audit or a court order, but by a hacking incident. Data obtained through that breach and reported by 404 Media (as covered by The Verge) reveals that Suno trained its AI models by scraping millions of songs and lyrics from major online audio platforms, including YouTube Music, Deezer, and Genius.
This is a significant development in the ongoing debate over what AI companies can and cannot take from the internet to power their models — and it raises questions that go well beyond Suno itself.
What the Leaked Data Actually Shows
The core revelation is straightforward but consequential: Suno did not license the music and lyrics it used to train its generative AI. Instead, it appears to have scraped that content directly from online platforms without the knowledge or consent of the artists, labels, or rights holders who own it.
YouTube Music, Deezer, and Genius are not obscure corners of the internet. They are mainstream platforms that host an enormous breadth of copyrighted material — from mainstream pop and film scores to independent artists who depend on streaming revenues for their livelihoods. Genius, in particular, is one of the largest repositories of song lyrics on the web, a platform that itself has faced legal scrutiny over the years for how it acquires and displays lyrics. The fact that Suno allegedly scraped from all three simultaneously suggests a systematic, large-scale data acquisition effort, not an incidental or accidental one.
What makes this leak especially revealing is that Suno had actively avoided disclosing what was in its training data. The company’s legal strategy in ongoing litigation had leaned on that ambiguity. With this data now exposed, that ambiguity is gone.
The RIAA Lawsuit and the Admission That Changed the Narrative
Suno is not new to legal trouble. The Recording Industry Association of America (RIAA) filed a notable lawsuit against the company alleging that it used copyrighted materials to train its AI models. In the course of that litigation, Suno openly admitted to using copyrighted content in its training process — a striking acknowledgement from a company that had otherwise been reticent about its data practices.
The RIAA represents the interests of major record labels and, by extension, the artists whose work those labels distribute. Their lawsuit against Suno fits into a broader legal offensive by the music industry against AI companies that generate audio. The underlying legal question in these cases is deceptively simple to state but enormously complex to resolve: does using copyrighted music to train an AI model constitute copyright infringement, or is it protected under the doctrine of fair use?
Fair use is a cornerstone of American copyright law. It allows limited use of copyrighted material without permission in contexts such as commentary, criticism, education, and transformative creative work. AI companies have argued — with varying degrees of success in court — that training on copyrighted data is transformative and therefore qualifies as fair use. Rights holders counter that mass scraping for commercial AI development is not transformative in any meaningful legal sense, and that it directly undermines the market for the original works.
Fair Use or Systematic Theft? The Philosophical and Legal Divide
The question of where fair use ends and infringement begins is not academic. It has real financial consequences for artists, labels, and AI companies alike.
Consider the scale involved. When an AI music generator scrapes millions of songs, it is not borrowing a few bars of melody for a review or analysis. It is ingesting entire catalogues — rhythms, harmonics, lyrical structures, production techniques — and using that ingestion to build a commercial product that then competes directly with the musicians whose work it consumed. An artist in India or anywhere else who earns royalties from Deezer streams, for instance, has no idea their work may have been fed into a machine that now generates music in a style similar to theirs, potentially cannibalising the very audience they depend on.
This is the crux of the moral argument that sits beneath the legal one. Even if a court ultimately rules that certain forms of AI training qualify as fair use under existing statutes, that ruling would not resolve the ethical question of whether such use is fair in any ordinary sense of the word. Copyright law was designed for a world where infringement meant copying and distributing a work — not for a world where an entire musical tradition could be absorbed, processed, and monetised by a software system at a scale no human could replicate.
What This Means for the Broader AI Industry
Suno’s situation is not isolated. Across the AI landscape — from image generators to large language models to music tools — questions about training data provenance are becoming impossible to ignore. Courts, regulators, and the public are all demanding greater transparency about what these systems were built on.
The fact that Suno’s data practices were exposed through a hack rather than voluntary disclosure is itself telling. It suggests that, left to their own devices, many AI companies would prefer to keep their training pipelines opaque. That opacity may be legally strategic, but it is corrosive to trust — both with the creative communities these tools depend on and with the broader public that is increasingly asked to integrate AI into daily life.
For the music industry specifically, the Suno revelations add urgency to calls for legislation that would require AI companies to disclose their training datasets and obtain licenses for copyrighted content. Several such proposals are already circulating in the United States and the European Union. India’s own evolving framework around AI governance and copyright will eventually need to address similar questions as domestic AI tools and global platforms compete for the same market.
The Artist’s Perspective: Invisible Labour, Visible Product
Behind every data point in Suno’s training set is a human being who made creative decisions — who chose a chord progression, wrote a verse, recorded a bridge at two in the morning. Those decisions took skill, time, and in many cases, significant financial investment. When that labour is scraped without consent or compensation and used to train a commercial AI product, it represents a transfer of value that the original creator never agreed to and receives nothing for.
This is not a hypothetical concern for musicians in India, where the recorded music industry has grown substantially over the past decade, driven by streaming platforms including YouTube Music and Deezer. Independent artists who have built audiences on these platforms may find that their work — uploaded in good faith to reach listeners — has also been feeding AI training pipelines.
What Comes Next
The Suno data leak is unlikely to be the last of its kind. As AI companies face mounting litigation and regulatory pressure, more details about training data practices will inevitably surface — whether through legal discovery, whistleblowers, or, as in this case, security incidents.
For Suno, the immediate challenge is navigating ongoing litigation with its training data now partially exposed. For the broader AI industry, this moment serves as a warning: opacity about data provenance is not a sustainable strategy. The creative industries are organised, litigious, and increasingly effective at making their case in court and in the court of public opinion.
The deeper question — whether the legal frameworks we have are adequate to govern AI training at scale — remains genuinely unresolved. What the Suno case makes clear is that the current period of ambiguity, where companies train on whatever they can access and hope the law catches up in their favour, is drawing to a close. The reckoning, for Suno and for the AI industry as a whole, is already underway.
