Suno has long acknowledged that its AI music generator relied on the scraping of millions of songs available across the internet, but a new hack reveals just how the company pulled from streaming services and websites such as YouTube Music, Deezer and Genius to power its product — all while user information remained vulnerable.

A report in 404 Media on Wednesday, relying on data a hacker obtained last year and provided to the outlet, showed the instructions in the company’s source code had it scrape files from “genius_hq, youtube_music, freesound, jamendo, imp, deezer,” with the stock music libraries Freesound, Jamendo and the International Music Score Library Project among the other sources scraped. The instructions demanded that “non-music” be filtered out. The hacker also had access to Suno’s customer list, which included emails, phone numbers and Stripe payment details, according to the report.

Representatives for YouTube Music, Genius, and the stock libraries scraped did not respond to immediate requests for comment.

Deezer said in a statement that it has “always been on the side of the artists, and training data for generative AI should always be attained with clear approval and fair compensation.”