Suno's leaked code confirms it scraped Deezer, YouTube, Genius
On July 15, 2026, 404 Media reported that a hacker breached Suno and shared internal source code. The code lists YouTube Music, Deezer and Genius among the platforms Suno scraped to train its music-generation models. It corroborates UMG and Sony's central claim in the RIAA-coordinated copyright lawsuit.
What the leak contains
- Suno's source code, listing YouTube Music, Deezer and Genius as scraping sources.
- Hundreds of thousands of user records — emails and/or phone numbers.
- Stripe payment details from Suno customers.
Suno had already admitted in a court filing that its training corpus was drawn from "music available on the open internet." The leaked code moves that from a legal disclosure to a naming of specific platforms — the exact fact pattern UMG and Sony have argued to the court.
Why this matters if you distribute music
The lawsuit outcome will take months. Two things do not wait for the verdict:
- DSP pressure escalates. Qobuz already rejects 100% AI-generated content at delivery via FUGA (covered here). Every new headline about scraped training data gives Spotify, Apple and Deezer more reason to tighten their own filters. If you deliver Suno-generated tracks without flagging them, you're on the front line of that tightening.
- Provenance liability grows. A distributor knowingly shipping tracks generated by a tool built on scraped copyrighted works is a much harder story to defend than one that filtered them out at ingest. "We didn't know" was already thin. After this leak it's thinner.
The industry conversation was: "is Suno legal?" It just became: "what did Suno actually train on, and are the tracks you're distributing derivative of it?"
What you can do this week
Two concrete steps, whether you use DistroShield or not:
- Sample your last 30 days of deliveries. Run them through any AI detector — ours, Pex, Audible Magic, a homegrown model. Anything flagged 100% AI is a candidate to review before a DSP flags it for you.
- Wire pre-upload detection into your ingest. Before your DDEX generator runs. Response tells you deliver / hold / block per track and gives you an audit trail if a rightsholder asks later.
Sources: 404 Media (original reporting) · Music Business Worldwide (industry summary). Nothing in this post is legal advice; it is an operational read for distributors.