The Label Report — Music Business News & Insight

If you make music, manage artists, or run a label, you have spent the last two years listening to AI companies insist they trained on "publicly available" material and that everything is fair use. You could argue with the theory. What you could not do was see inside the machine.

Now you can. And it looks exactly like what the majors have been alleging all along.

A hacker who breached Suno handed the company's internal source code to 404 Media, and the documents show in plain text which services Suno pulled from to train its models. This is not inference from listening tests or clever prompting. This is the plumbing, with the sources named. As Digital Music News reported, the leak reveals the scale of the copyrighted songs and lyrics scraped to build the product.

The instructions in Suno's code told it to scrape files from sources labeled "genius_hq, youtube_music, freesound, jamendo, imp, deezer," per Variety. In other words, licensed streaming services and a major lyrics platform, sitting right next to stock libraries. The code even demanded that "non-music" be filtered out, which tells you the pull was targeted, not accidental.

The Numbers Are the Story

The dataset comments read like an inventory. Variety, citing the 404 Media report, listed "113,879 hours of youtube_music," "17,615 hours of genius_hq," "12,287 hours of deezer," plus "19,514 hours of imslp," "3,726 hours of jamendo," "62,117 hours of pond5_music," "152,162 hours of ytm_tagged," and "103 hours of musescore_lyrics." One YouTube Music file alone logged "2,013,545 music clips" at its last update.

Read those source names again. YouTube Music. Deezer. Genius. These are licensed, paywalled, terms-of-service-bound platforms, not some open field of orphaned MP3s. Scraping catalog off a subscription streaming service is a very different legal posture than crawling the open web, and Suno's own code appears to spell out that it did exactly that.

A cracked digital vault spilling streams of musical notes into a swirling data vortex — Hidden code reveals music platforms used as AI training sources

Why "Outdated Code" Doesn't Fix This

Suno's response is careful. A spokesperson told Variety the breach was "quickly contained" after the company learned of it in November 2025, and that it mostly exposed "outdated source code that is no longer in use." The company says it does not retain full credit card numbers, that no sensitive user information was compromised, and that it did not feel obligated to notify users because the breach was limited.

Set aside the security angle for a second, though the leaked customer list of emails, phone numbers, and Stripe payment details is its own problem. From a copyright standpoint, "outdated" is not a defense. The lawsuits are about how the models that exist today were trained. Old code that documents old scraping still describes the training runs that produced the product now generating songs at scale.

Suno's public line, repeated to both outlets, is that its models were trained on "essentially all music files of reasonable quality that are accessible on the open Internet," and that this is fair use. The spokesperson also leaned on the "Original Creation, By Design" framing, noting Suno deliberately does not use artist names as training metadata and blocks users from prompting with specific artist, song, or album names.

Fine. But the fair use fight was always going to turn on how the training data was acquired, and now there is a document that names the sources.

What This Means for the Litigation, and for Everyone Else

Universal Music Group, Sony Music Entertainment, and the RIAA are suing Suno for copyright infringement. Variety, in its report on the hack, linked to coverage of Suno asking a court the majors from expanding the suit to over 61,000 recordings. Discovery is normally where you fight to see this kind of internal evidence. A hacker just skipped the line.

A hooded anonymous figure holds a glowing scroll of leaked code in a misty server room — A leaked code leak exposes the secrets behind an AI music company

Warner Music Group already settled and is now building a licensed model with Suno. The two paths in front of every rightsholder are getting clearer: sue, or cut a deal. This leak strengthens the hand of anyone choosing the first.

And it is not just the majors named in the suit. Suno's code pulled from Deezer, Genius, and stock libraries too. Every AI music company that has hidden behind "publicly available" now has to wonder what its own source code would say if it leaked.

The timing is brutal for Suno specifically. The company is prepping a major IPO and just rolled out an iMessage text-to-song feature built with Apple, a platform Digital Music News notes now sees 7 million songs generated each day. Investors and partners now have a plain-language map of the litigation risk they are buying into.

For years the AI music debate ran on inference. The math never fully closed, but you could always argue about intent. That gap just shrank. When your own code names the streaming services you crawled, "open internet" stops being a shield and starts being an admission.

Suno's Leaked Source Code Names the Streaming Services It Scraped

The Numbers Are the Story

Why "Outdated Code" Doesn't Fix This

What This Means for the Litigation, and for Everyone Else

Sources

The music business, decoded.