Mercor

Summary

Mercor experienced a data breach after attackers compromised the open‑source LiteLLM library, inserting malicious versions that harvested credentials and exfiltrated approximately four terabytes of data including personal information, source code, video interviews and proprietary AI training details. The incident prompted several class‑action lawsuits alleging inadequate cybersecurity protections, led Meta to suspend its collaboration with the firm, and triggered investigations by OpenAI and other AI labs, while the hacking group Lapsus$ claimed responsibility and offered the stolen data for sale.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 27, 2026, a threat actor group known as TeamPCP compromised the continuous integration and continuous delivery pipeline of the open‑source LiteLLM library after obtaining a maintainer’s credentials through a prior supply‑chain attack on the Trivy security scanner. Using those credentials, TeamPCP published two malicious versions of LiteLLM—1.82.7 and 1.82.8—to the Python Package Index, where they remained available for approximately forty minutes before being detected and removed. The poisoned packages contained credential‑harvesting malware that executed on import or on every Python process startup, exfiltrating environment variables, API keys, SSH keys, cloud credentials, Kubernetes configurations, CI/CD secrets and database credentials to a server at models.litellm[.]cloud. Mercor, which relies on LiteLLM to connect its platform to AI services, confirmed that it was one of thousands of organizations affected by this supply‑chain attack.

Mercor disclosed that the breach resulted in the exfiltration of roughly four terabytes of data, including 939 gigabytes of platform source code, a 211‑gigabyte user database and approximately three terabytes of video interview recordings and identity verification documents. The stolen cache also contained candidate profiles, personally identifiable information such as full names and Social Security numbers of more than forty thousand current and former contractors and customers, employer data, API keys, TailScale VPN data and proprietary training‑set details. Because Mercor supplies bespoke training data to AI labs including Meta, OpenAI, Anthropic and Google, the exposure raised concerns that data selection criteria, labeling protocols and training methodologies used by those companies may have been compromised. In early April 2026, at least four class‑action lawsuits were filed in the U.S. District Court for the Northern District of California by independent contractors who used Mercor’s platform, alleging negligence, breach of privacy, unjust enrichment and violations of California’s Unfair Competition Law, and seeking class certification, injunctive relief and reimbursement for out‑of‑pocket costs related to fraud, identity theft and data recovery.

Mercor stated that its security team moved promptly to contain and remediate the incident and that it was conducting a thorough investigation with the assistance of leading third‑party forensics experts, while committing to keep customers and contractors informed as appropriate. The company said it would devote the resources necessary to resolve the matter as soon as possible, but it did not comment on the authenticity of the data claimed by the hacking group Lapsus$, which had posted the alleged stolen files on dark‑web forums and auctioned them for sale. Meta announced an indefinite pause of its work with Mercor, citing the risk to its AI training secrets, while OpenAI confirmed it was investigating its exposure but had not paused or terminated its contracts; Anthropic and Google have not publicly disclosed their positions but are understood to be assessing the breach’s scope. The incident has prompted multiple AI labs to review their reliance on shared data vendors and has highlighted the systemic risk posed by supply‑chain compromises in the AI training pipeline.

Sources

Sources available to members: 4 sources.