Suno Gets Exposed By Its Own Code | A Hack, a Munich Ruling, and a Musicians' Union Demanding Answers 🤖🎶

If you want to see exactly how shady an AI music company can get, this post is for you.

On July 15, a hacker who breached Suno’s servers handed 404 Media the company’s source code, confirming what artist groups, UMG and Sony have spent two years alleging in federal court.

Suno scraped YouTube, Deezer, Genius, and half a dozen other platforms wholesale without anyone’s permission.

Share

Two weeks later, a Munich court ruled that doing so broke both German and U.S. copyright law, and ordered Suno to show its books.

And, the American Federation of Musicians (AFM) sued Universal and Warner over a fairly straightforward question.

The labels settled with Suno for hundreds of millions of dollars. So where is the money owed to the musicians who actually performed on those stolen records?

These stories are about the same AI music company exposed from three angles. Unveiled by a hacker, ruled against by a foreign court, and quietly dealt with by two major labels who would rather fight a union than answer where the money went. But, none of these stories left a real dent on Suno.

They can lose all three fights and still come out ahead. That’s their business model.

A hacker using the handle “ellie.191” breached Suno using a supply-chain worm called “Shai-Hulud” that harvests GitHub and cloud-service credentials. The 404 Media report about this incident confirmed what artists & the recording industry had already alleged in federal court.

There were nine named sources in the leaked code; namely

YouTube Music, Genius, Deezer, Pond5, the International Music Score Library Project, Freesound, Jamendo, MuseScore, and a separately tagged YouTube set.

That totals to 381,813 hours of illegally scraped audio, which is roughly 43.6 years of audio played back to back. Close to 70% of that material traces to YouTube alone. The leaked code shows 113,879 hours of audio extracted from a raw scrape, and another 152,162 hours tagged for training signal, amounting to over 2 million (2,013,545) clips all in. The code also shows how the system hunted YouTube for acapella tracks to isolate vocals. This operation was routed through a proxy infrastructure from a company called Bright Data, alongside an attempt to pull (steal) roughly a million hours of audio from 420,000 podcasts.

That lines up with what UMG and Sony have already alleged in their amended complaint. Suno engaged in “stream ripping” and circumvented YouTube’s encryption, invoking the Copyright Act’s anti-circumvention provisions which carry more serious consequences than an ordinary infringement. It also collides with Suno’s own prior filings, which describe its training data as drawn from

“essentially all music files of reasonable quality that are accessible on the open internet, abiding by paywalls, password protections, and the like.”

Two of the platforms in this leaked code (Deezer and Pond5) sit behind the exact paywalls that statement claims to respect. So that’s a blatant lie.

A Suno spokesperson told 404 Media that the breach

“primarily involved outdated source code that is no longer in use.”

You can believe that if you want to, we don’t. That “outdated” framing fits oddly with the timing. Recently, UMG and Sony moved to expand their case against Suno from 560 named works to 61,026 tracks identified through audio fingerprinting, pushing the theoretical damages ceiling from roughly $84 million to more than $9 billion.

The same breach exposed personal data for 55.3 million Suno accounts including names, phone numbers, addresses, and Stripe payment records with partial card numbers and expiry dates, as confirmed by Have I Been Pwned.

Suno’s public claim that “no sensitive personal information was compromised” directly contradicts with Have I Been Pwned’s disclosure.

By the way, Suno raised $400 million in June this year despite all these controversies surrounding them.

Germany’s GEMA got the first major victory against Suno.

On July 31, the Munich Regional Court ruled that Suno was not entitled to use music represented by the society, ordering disclosure of revenue tied to the infringing works and finding it liable for damages. The exact figure is not yet set.

GEMA represents roughly 95,000 members and licenses on behalf of more than 2 million rights-holders worldwide. They built their case around a sharper claim than similar American lawsuits. They did not just allege that Suno trained on copyrighted songs, but that its outputs reproduce them. The case centred on six protected compositions; namely

“Atemlos durch die Nacht,” “Rasputin,” “Big in Japan,” “Forever Young,” “Daddy Cool,” and “Mambo No. 5.”

At a March hearing, GEMA played the songs side by side with Suno outputs. The similarities in melody, harmony and rhythm were close enough that the original tracks were easily recognizable. That’s a sharper target than a training-data argument as here the blatant copying shows up directly in what the paying customer actually hears.

What makes this ruling a bit unusual is the reasoning underneath it. All of Suno’s defences failed.

The court found that Suno's models "memorize" protected works into their parameters. This is treated as a reproduction under German law. Therefore, the court ruled that Germany’s text-and-data-mining (TDM) exception didn't cover it, both because memorization goes beyond what the exception protects and because Suno lacked lawful access in the first place, having obtained the recordings by circumventing YouTube's download protections.

The German court applied U.S. fair-use doctrine to Suno's state-side training and set future damages at €250,000 per breach. Actual damages for the infringement itself haven't been calculated yet as the court ordered Suno to disclose its revenue first.

This is the same Munich chamber that ruled against OpenAI in November 2025 over ChatGPT reproducing German lyrics in Europe’s first ruling to side with creators against a generative AI system. The Suno case extends that logic into GEMA’s core business of playable recordings. Unsurprisingly, Suno fundamentally disagrees and is evaluating an appeal.

We don't know how much Suno will have to pay yet but we do know that they have to pay something.

Real, working-class musicians are the most affected by all this.

In November 2025, Warner Music Group settled its portion of a $500 million copyright suit against Suno. As part of the deal, Suno also acquired Warner’s Songkick concert-data platform, which we covered previously.

Neither the settlement amount, nor the licensing terms, or the Songkick price have ever been disclosed.

Universal Music Group, meanwhile, reportedly sought not just license fees from Suno and Udio but a stake in both. They are profiting twice, once from the settlement, and again from the annual profits generated by Suno & Udio.

Now let’s compare that to one number that IS public. Under the Sound Recording Labor Agreement (SRLA) [the union contract governing session musicians who performed on many of the recordings Suno was trained on]

The basic scale wage for a minimum-call session is $488.29.

That’s the number the American Federation of Musicians (AFM) says its members are owed per recording session, and the number Warner and Universal are fighting in court to avoid discussing at all.

Filed in June, AFM’s lawsuit invokes Article 21(a) which is a “new use” clause requiring payment whenever a recording is licensed for a purpose the original contract didn’t anticipate. But, Warner’s response letter argues the opposite, saying

“Use of sound recordings in generative AI software models is not a purpose covered by the SRLA, so there is no entitlement to payment.”

The AFM’s recently amended complaint explicitly added Warner Records and Atlantic Records directly alongside Universal Music as named defendants. They called Warner’s response “nonsensical,” noting that

when labels first licensed recordings for video games, no specific AFM rate agreement existed then either, yet the industry still treated it as compensable.

Universal settled with Udio in October 2025, Warner settled with both Udio and Suno weeks later. Every settlement generated new, undisclosed revenue for the labels. But every musician whose performance trained those models has received nothing.

Somewhere in the filing cabinets at Universal and Warner sits the actual dollar figure of the Suno settlements; sealed and undisclosed in every press release about it. Somewhere else, public and typed to the cent, sits $488.29, the price of a working musician’s day. One number is sealed to protect leverage. The other was published to guarantee a floor. A floor that was set before AI licensing existed and has never once been renegotiated.

That’s the same asymmetry running through all three stories, just at different scales.

Suno’s secrets became public only when someone broke into its servers. The German court ruled Suno was liable & ordered the company to disclose revenue information. And now the AFM is arguing over whether a decades-old contract clause applies to AI licensing.

The labels, meanwhile, have already cashed in and reached settlements.

None of this will cost Suno what it should. Not the hack. Not the verdict. Not the lawsuit.

The company has $775 million in venture and private-equity capital behind it at a $5.4 billion valuation. Investors had priced in this exact outcome before Suno ever launched to market. Getting called out and caught multiple times isn’t a crisis for a company like this.

The receipts are in. The verdict is in. The lawsuit is filed. But none of it adds up to a single dollar moving from Suno's account to a musician's. That's the AI music business model working exactly as intended…

🫵🏼 What do YOU think? Are these lawsuits building toward real accountability, or just setting the going rate for infringement when you can afford to pay it? Let us know your thoughts…

💬 If this one got under your skin; drop a like, share your thoughts below & share this investigation with every artist and music fan you know. The future of human creativity depends on holding these companies accountable. Consider supporting artists directly through platforms like Bandcamp, where musicians set their own prices and keep a fair share of revenue.

🤝🏼 Join us at Vinyl Culture as we continue exploring ways to preserve and evolve an authentic music culture in an age dominated by algorithms and corporate interests. We are building something that will revolutionize the music industry by creating an Artist-centred and Community-driven platform, leveraging both the offline & online medium. We will empower artists by allowing them to share their art and creativity directly with the fans. More on this soon…

8️⃣0️⃣0️⃣0️⃣+ SUBSCRIBERS have now joined our mission to protect The Soul of Music in the age of algorithmic manipulation & AI. Thanks a lot to each & every one of you!! 🫵🏼 🤝🏼

🙌🏻 Together, we can make a difference.