Central Intelligence
Central Intelligence®PERSPECTIVE IS EVERYTHING
Last Update: 10/27/2026 at 6:00 AM EST

Mercor-LiteLLM Data Breach

Coverage from All About Cookies, Federman & Sherwood, and others

Mercor-LiteLLM Data Breach topic image

A malicious update to the open-source LiteLLM tool gave attackers a route into systems associated with Mercor, an AI staffing and data-training company.

Reported exposed material includes contractor identity documents, facial and voice biometrics, interview recordings, Social Security numbers, source code, credentials, and internal data. Mercor commissioned forensic investigations and reported limited exposure, while independent reporting and lawsuits described a larger potential theft and alleged inadequate safeguards. The incident also affected commercial relationships, including reported scrutiny or suspension of work by Meta, and led to class-action litigation in California and Texas.

Looking Back
149 Day Timeline
Mar 31Apr 28May 26Jun 23Jul 21Aug 18
All Articles9 articles
Important5 articles · CI Score 60 and above
All About Cookies / Thomas Kent
Mercor Breach Exposed SSNs, Biometrics In LiteLLM Attack
Mercor notified affected contractors in late June 2026 after a March LiteLLM supply-chain attack allegedly exposed passport scans, Social Security numbers, and facial biometrics.
6/26/2026 • Data Breaches & Exposure Events • General
Federman & Sherwood / Caroline Chesher
Mercadien Data Breach Exposed Sensitive Personal Information
Federman & Sherwood investigates the Mercadien, P.C. CPAs data breach in Maine after unauthorized third-party access potentially exposed Social Security numbers, addresses, and government IDs.
6/15/2026 • Data Breaches & Exposure Events • General
WebProNews / Eric Hastings
Mercor Breach Exposes Contractor Biometrics In LiteLLM Supply-Chain Attack
LiteLLM supply-chain attackers allegedly stole 4 terabytes of Mercor contractor data starting March 27, prompting class-action lawsuits in California and Texas.
4/28/2026 • Data Breaches & Exposure Events • General
Ruh AI
Mercor Breach Exposed Identity Data And AI Training Secrets
On March 27, 2026, a Trivy-related supply-chain compromise of LiteLLM led to theft of Mercor contractor identity verification data and credentials, prompting investigations and a class action.
4/25/2026 • Data Breaches & Exposure Events • General
Cybernews / Paulina Okunytė
Alleged 4TB Mercor Breach Exposes Logs, Prompts, And Roles
Attackers allegedly offered 4TB of Mercor databases and source code for sale in 2026 after earlier sensitive contractor-data exposure at the San Francisco recruiting company.
8/26/2026 • Data Breaches & Exposure Events • General
Interesting4 articles · CI Score 45–59
Staffing Industry Analysts
Mercor Tightens Security After March Data Breach Probe
Mercor announced post-breach cybersecurity upgrades in response to a March incident linked to malicious LiteLLM software and alleged data theft by Lapsus$.
7/9/2026 • Data Breaches & Exposure Events • General
Cybersecurity Insiders / Naveen Goud
Mercor Data Breach Costs AI Startup A Meta Contract
Mercor reported a data breach in the 2020s traced to the LiteLLM supply chain component, causing downtime and contract withdrawal by Meta.
4/6/2026 • Cybersecurity (Privacy-Relevant) • General
TechCrunch
Mercor Investigates Breach After Sensitive Data Exodus Claims
Mercor investigated a March 31 data breach after a hacker group claimed 4TB of stolen candidate profiles and API keys traced to credential-harvesting malware in LiteLLM.
4/9/2026 • Data Breaches & Exposure Events • General
Staffing Industry Analysts
Mercor Says It Contained Data Breach Linked To LiteLLM Attack
Mercor said it contained a LiteLLM supply chain-linked breach and began forensics-supported investigation after Wired reported March 31 internal confirmation, with Meta pausing work.
3/31/2026 • Data Breaches & Exposure Events • General