2026-03-31 · 2026-Q1
Mercor Data Breach via LiteLLM Supply Chain
Should this run hold this key at all?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
Mercor ($10B AI hiring startup)
Impact
40K+ people affected; Lapsus$ claims 4TB of data including PII, video interviews, credentials, source code; class action filed
Root cause
Cascading supply chain: TeamPCP compromised Trivy, stole LiteLLM credentials, published poisoned PyPI packages
Sources
Catalog
Cite this: AgentProv incident record: Mercor Data Breach via LiteLLM Supply Chain (2026-03-31). https://agentprov.com/incidents/2026-03-31-mercor-data-breach-via-litellm-supply-chain
Related
- Same event · 2026-03-24LiteLLM Supply Chain Attack by TeamPCPL1Credential
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential