Everyone knew Suno trained on “everything.” The hack names the files.

The file names are the story: “youtube_music.” “deezer.” “genius_hq.” “ytm_tagged.” On Wednesday, Jason Koebler at 404 Media reported that a hacker breached Suno, the AI music generator, and shared source code, apparently from 2023 and 2024, that spells out where the company’s training data came from, not as a lawyer’s abstraction but as named datasets with hour counts attached.

The counts, per 404 Media: one file listed 2,013,545 music clips scraped from YouTube Music. A tally elsewhere in the code recorded 113,879 hours of “youtube_music,” 62,117 hours of “pond5_music,” 17,615 hours of “genius_hq,” and 410 hours from Freesound, alongside material from Jamendo, Deezer, the International Music Score Library Project, and podcasts pulled down through RSS feeds. Decades of audio, itemized.

The breach was worse than embarrassing. The exposed data also included personal information for hundreds of thousands of Suno customers plus Stripe payment details, according to 404 Media. TechCrunch, summarizing the report, adds that the hacker described getting in through a supply-chain attack on an employee’s credentials in November 2025, that Suno characterized the event as a “limited security incident that was quickly contained,” and that the company never notified its customers.

Here is what the hack did not reveal: that Suno trained on copyrighted music. Everyone knew. Suno told a federal court itself, in its August 2024 answer to the major labels’ lawsuit, in a sentence first flagged by 404 Media at the time:

“Suno’s training data includes essentially all music files of reasonable quality that are accessible on the open internet.”

That was the industry’s “everything” moment. What the labels have spent the two years since trying to establish is the granularity underneath it: which services, which catalogs, which recordings. The hack skips to the answer key.

The slow way was working, slowly

Sony, Universal, and Warner filed against Suno on June 24, 2024, in federal court in Massachusetts, with a parallel RIAA-coordinated case against Udio in the Southern District of New York. “These are straightforward cases of copyright infringement involving unlicensed copying of sound recordings on a massive scale,” RIAA chief legal officer Ken Doroshow said at the time. Statutory damages run up to $150,000 per willfully infringed work, which makes the number of works the whole game.

Warner has since left the fight, settling in November 2025 and signing a licensing deal under which Suno will launch licensed models in 2026 and deprecate the current ones. Universal and Sony are still in, and the live dispute, as Music Business Worldwide has tracked, is over scale: the labels ran audio-fingerprinting on Suno’s training data and moved on May 21 to add 61,026 recordings to the complaint, which would push Suno’s theoretical exposure from roughly $84 million to more than $9 billion.

Suno is fighting the addition, and on July 2 it put a helpful precedent in front of Judge F. Dennis Saylor IV — Judge Alvin Hellerstein’s June 29 ruling in the Udio case, which denied Sony’s bid to add 30,442 recordings that late in the schedule. Fact discovery in Boston closes September 30.

Read that fingerprinting detail again. It means discovery already reached the training data itself. Suno produced it and the labels analyzed it; the recording count came out through motions and protective-order procedure. The hack did not beat discovery to the facts.

It beat discovery to the public.

What stolen files are worth in a courtroom

Less than you might think, and differently. American civil courts have no general rule excluding evidence because a third party stole it; the Supreme Court held as far back as Burdeau v. McDowell in 1921, a criminal matter, that papers taken by a private party could still be used against their owner. The real gate is authentication under Federal Rule of Evidence 901: whoever offers the files has to show they are what they claim to be — genuine Suno code, unaltered between the breach and the exhibit sticker. An anonymous hacker who will never testify makes that hard. A defendant with every incentive to allege tampering makes it harder.

Our read: this cache is unlikely to ever be marked as an exhibit, and it doesn’t need to be. Its value to plaintiffs is as a map. You cannot un-know a dataset called “ytm_tagged.” Interrogatories and document requests can now name names, and any gap between what the leak describes and what Suno has produced in discovery becomes its own line of questioning. That is speculation, ours, but it is how leaked material usually works on litigation: not as proof, as direction.

A disclosure that house rules require and that honesty demands anyway: this article rests on data taken in a crime. We have not seen the hacked files. 404 Media has, and our account of their contents depends entirely on Koebler’s reporting, which is why his outlet is linked in nearly every paragraph above. The hacker’s identity and motives are unknown, at least publicly. And the same breach that itemized Suno’s scraping exposed ordinary users’ contact details and payment records. Whatever the leak clarifies about training data, the people it hurt first are the customers Suno reportedly never told.

There is a pattern here, but it is not “leaks beat lawsuits.” Most of what the public knows about AI training corpora arrived the slow lawful way: Meta’s use of the LibGen shadow library and Anthropic’s book-acquisition pipeline both surfaced through court filings in Kadrey v. Meta and Bartz v. Anthropic, and Suno’s own “everything” sentence sits in a legal answer it was compelled to file. Court or hacker, the disclosure is always involuntary. No major AI company has yet published its training manifest because it decided the public should have one.

The open internet, which is where Suno said it found the music, got its copy of the production eleven weeks early.