Suno hack: leaked code shows scraping of YouTube Music, Deezer and Genius; breach of 55M user accounts leads to class actions
On July 15, 2026 404 Media reported that a hacker who breached Suno in November 2025 had shared internal source code from 2023–24. It shows scraping of millions of music clips from YouTube Music plus Deezer, Genius and other sources for training. On July 20 Have I Been Pwned added the breach: 55.3M unique email addresses, phone numbers and tens of thousands of Stripe purchase records. Suno had not notified users. At least three proposed class actions followed in federal court in Massachusetts.
Key facts
- 404 Media (Jason Koebler, July 15, 2026): leaked scraping instructions list 2,013,545 YouTube Music clips (113,879 hours), 12,287 hours from Deezer and 17,615 hours from Genius, plus Pond5, Jamendo, Freesound, IMSLP and podcasts via RSS
- Context: Suno had already admitted in litigation that it trained on 'essentially all music files of reasonable quality that are accessible on the open internet'
- Have I Been Pwned (added July 20, 2026): breach date Nov 25, 2025; 55,282,226 accounts; emails, phone numbers (for phone sign-ups), and for a small subset names, physical addresses, purchases and partial card data (type, expiry, last 4)
- Suno: no access to full card numbers; breach 'quickly contained' and involved 'outdated source code'; third-party auditors hired. It concluded individual notifications 'were not warranted under applicable privacy laws' (MBW)
- Lawsuits (D. Mass.): Pilavian v. Suno filed July 24, 2026; consolidated with Rugnetta v. Suno by Judge Allison D. Burroughs on Aug 24 (Pilavian lead); a third suit by Michael Beckham filed Sept 3. Claims: negligence, breach of implied contract, unjust enrichment, declaratory relief
What happened
A hacker breached Suno, the largest AI music app, in November 2025. In July 2026 the hacker gave 404 Media part of Suno's training pipeline code. It documents systematic scraping of commercial music services. Days later the user database appeared on Have I Been Pwned, the first public sign for most users, about eight months after the breach. Suno said it had contained the incident and did not consider individual notice legally required. Plaintiffs' firms filed proposed class actions in Suno's home court in Massachusetts.
Why it matters
The leak gave rare documentary evidence of how a leading generative-music company built its training set, at a time when it was settling with labels and fighting GEMA, Round Hill, and artist class actions. Separately, a breach of 55 million accounts made Suno one of the largest consumer data breaches at an AI company so far.
Changelog
- 2026-10-02: created (from leads queue; TechCrunch watermarking article mentioned the breach)
Related events
- Suno adds audio watermarking, fingerprinting and download limits amid lawsuits ★★
- Jason Isbell leads musicians' class action accusing Suno of exploiting artists' identities ★★
- German court rules against Suno in the first European AI-music copyright case (GEMA v Suno) ★★★
- Suno launches v6, its first music models trained on licensed music ★★★
- Round Hill Music sues Suno and Anthropic for up to $1B each over training on its songs ★★★
Sources (5)
- press404 Media: Hack reveals Suno AI music generator scraped YouTube, Deezer and Genius
- officialHave I Been Pwned: Suno breach
- pressMusic Business Worldwide: Suno faces proposed class action lawsuit over data breach (July 28)
- pressMusic Business Worldwide: Suno hit with another proposed class action over data breach (Sept 17)
- discussionHall Attorneys: class action against Suno over reported data breach
id: 2026-07-15-suno-hack-scraping-data-breach · updated 2026-10-02 · open in the interactive timeline