What did the hack actually expose?
In November 2025, a hacker used the Shai-Hulud worm, a supply-chain attack that spreads through compromised npm packages, to steal a Suno employee's credentials and get into the company's GitHub and cloud storage. That gave the hacker access to source code and internal logs from 2023 and 2024, the period when Suno built the datasets that trained its song-generating models.
Those logs, shared with 404 Media and reported on July 15, 2026, read like a shopping list. YouTube Music alone accounts for 2,013,545 individual clips and 113,879 hours of ingested audio, with another 152,162 hours logged separately under a tagged pipeline. Genius contributed 17,615 hours, Deezer 12,287 hours, and the stock library Pond5 a staggering 62,117 hours. Jamendo, Freesound, the International Music Score Library Project and podcast RSS feeds round out the list. According to reporting on the source code, Suno routed some of the YouTube scraping through Bright Data's proxy network, rotating IP addresses to get around YouTube's anti-scraping defenses, exactly the kind of circumvention the RIAA cited in its September 2025 amended complaint against the company.
"Essentially all music files of reasonable quality that are accessible on the open internet"
That is how Suno itself described its training approach in an earlier court filing, admitting to ingesting tens of millions of recordings. The leaked pipeline stats are the first time anyone outside the company has seen what that admission actually adds up to, source by source.
Why didn't Suno tell its customers?
The same intrusion exposed account data for hundreds of thousands of Suno users: emails, phone numbers, and partial payment details held through Stripe. Suno says it learned of the breach shortly after it happened, called it "a limited security incident that was quickly contained," and maintains it never held full credit card numbers or other sensitive personal information. What it did not do, according to customers who spoke to 404 Media, is tell them. Eight months passed between the intrusion and the first public confirmation, and that confirmation came from a reporter, not from Suno.
How does this change Suno's legal fight?
Suno is still defending itself against a copyright suit brought by major labels in 2024; Warner Music Group dropped its own claim after striking a licensing deal later that year, while Universal and Sony have kept pressing. In Germany, the collecting society GEMA has a separate case against Suno heading to a verdict in Munich on July 31, 2026, just over two weeks after the leak surfaced. The US case has more room to breathe: a Massachusetts court pushed dispositive motions back to April 2027. For rights holders, the leaked pipeline logs are less a surprise than a paper trail: operational proof, in Suno's own numbers, of exactly what a fair-use defense now has to explain away.
