Hacker Leaks Suno Source Code Exposing Massive Scraping of 2 Million YouTube Music Tracks and Customer Data Breach
A hacker operating under the pseudonym ellie.191 has leaked the internal source code of Suno, one of the largest AI-powered music generation platforms, to the investigative outlet 404 Media. The disclosure reveals how the company systematically scraped millions of copyrighted tracks and podcasts to train its generative models.
The leaked materials, believed to originate from 2023 and 2024, contain detailed instructions for downloading content and precise records of dataset sizes. According to the code, Suno obtained more than 2 million music fragments from YouTube Music alone. Additional sources listed in the files include Pond5, Jamendo, Freesound, the International Music Score Library Project, and MuseScore.
One dataset comprised over 152,000 hours of labeled audio from YouTube Music, while another collection from the same platform added 114,000 hours. Approximately 62,000 hours came from Pond5 and more than 12,000 hours from Deezer. Separate scripts were designed to locate karaoke-style versions of songs on YouTube to extract isolated vocals.
To facilitate large-scale downloads, Suno relied on proxy infrastructure provided by Bright Data. Another tool identified 420,000 podcasts and prepared nearly 1 million hours of recordings for ingestion.
The publication corroborates allegations previously made by the Recording Industry Association of America, which accused Suno of bypassing YouTube’s technical protections to copy protected works. Although Suno has publicly stated it trained on tens of millions of publicly available recordings under a fair-use rationale, rights holders continue to challenge this position in court.
In addition to the training data, the hacker claims to have obtained records belonging to hundreds of thousands of Suno customers, including email addresses, phone numbers, and partial payment information processed through Stripe. Several affected users have already verified to 404 Media that the exposed phone numbers match their accounts and that they never received breach notifications.
Suno responded that it detected a limited intrusion in November 2025 and quickly contained it. The company maintains that only outdated source code was accessed and denies that any sensitive personal or full payment card data was exposed. The hacker stated that access was achieved through an employee account infected by the Shai-Hulud worm, which harvested GitHub and cloud-service credentials, and that the operation was conducted out of general curiosity rather than targeted malice.
Related articles
SplitVPN Data Breach Exposes Personal Information of 865,000 Users
A data breach at the Russian VPN provider SplitVPN, formerly known as NotVPN, has exposed the personal details of approximately 865,000 users. The incident, which occurred in July 2026, involved a 17 GB SQL database containing emails, IP addresses, geolocation data, and partial payment card information. The stolen material was later distributed on a cybercrime forum, revealing 23.4 million user records, 13.6 million devices, and 2.6 million payment entries. Nearly 58 million connection logs spanning June 2025 to 21 July 2026 were also included, contradicting the company’s previous no-logs policy. The exposure is particularly concerning for users relying on the service to evade censorship and surveillance.
Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint
Security researcher BobDaHacker discovered an IDOR vulnerability in the official Click to Pray application run by the Pope's Worldwide Prayer Network. The flaw allowed anyone to retrieve full user profiles, including names, emails, countries, and birth dates, by simply incrementing numeric user IDs in API requests. No authorization checks or rate limits were present on the endpoint despite the service holding data for over 719,000 registered accounts. The researcher reported the issue to nine contacts in January 2026 but received no response for seven months. Dark Reading independently verified the exposure before publication, after which the endpoint was quickly restricted. The same service had suffered similar authorization failures in 2019 involving PIN code exposure through its eRosary application. The case highlights persistent gaps in object-level authorization and responsible disclosure channels at the Vatican-backed platform.
Measuring Data Leak Risk by Days of Silence Rather Than Megabytes in Cloud Environments
A financial expert turned security specialist argues that the true cost of data leaks in cloud offices stems not from the volume of exposed files but from the duration they remain undetected. The article details how routine actions such as making documents public, forwarding emails externally, or changing passwords can silently expose sensitive information in platforms like Yandex 360 without triggering any alerts. It warns against blanket prohibitions that push risky behavior into unmonitored channels like personal email or messengers, reducing visibility to zero. Instead, the recommended approach focuses on real-time event-driven notifications combined with automated remediation to minimize the window of exposure. The piece provides a detailed checklist for evaluating monitoring tools, including immediate reaction capabilities, self-healing actions, regular overview reports, and proof of system health. Emphasis is placed on secure integration via OAuth, data residency compliance, and the importance of treating employees as hurried professionals rather than malicious actors.
Russian Interior Ministry Opens Five Criminal Cases Against 'Glaz Boga' Analog Platforms Selling Personal Data of Russian Citizens
The Russian Ministry of Internal Affairs (MVD) has initiated five criminal investigations following the discovery of online platforms that sold personal data of Russian citizens, operating on the same model as the notorious 'Glaz Boga' service. These platforms allowed users to pay for access to detailed biographies and confidential information compiled into multiple files, including passport details, bank account records, and other sensitive personal information. The cases are being investigated under Article 272.1 of the Russian Criminal Code, which addresses the illegal use, transfer, collection, and storage of computer information containing personal data. Authorities have seized the servers of the implicated services and are currently analyzing their contents to gather evidence, although the specific names of the platforms, the number of clients, and the volume of data sold remain undisclosed. The developments highlight how repeated data leaks have transformed personal information into a marketable commodity traded on underground marketplaces, prompting law enforcement action against the operators responsible for distributing such data.