A Suno breach exposes more detail about its training-data pipeline

Leaked source code from a breach of Suno named YouTube Music, Deezer, Genius, Pond5, Jamendo, Freesound, IMSLP and podcast feeds among data sources used in the company's earlier training pipeline, according to reporting by 404 Media. The publication said the material included scraper instructions and dataset summaries from 2023 and 2024.

Those records are consistent with Suno's existing court position that it trained on music available across the open internet. They add operational detail to a fact already central to the company's copyright disputes; they do not by themselves decide whether that training was lawful.

This is also a security story

404 Media reported that the attacker accessed information associated with hundreds of thousands of customers, including contact and payment-related data. We are not reproducing leaked code, personal information or raw files. Users should rely on direct notices from Suno and their payment provider for any account-specific action.

The incident brings two transparency problems together. Creators have asked model companies to identify training sources, while customers expect those companies to protect account data. A breach is not an acceptable substitute for either form of disclosure.

For the copyright cases, the relevant evidence will be authenticated filings and material admitted by the courts. For users, the immediate issue is simpler: a creative platform holding both large training corpora and customer records needs a public, specific account of what was accessed, what has been secured and what affected people should do next.