In short: In late March 2026, attackers stole 4 TB of data from Mercor — an AI recruiting platform serving OpenAI, Google, Meta and Microsoft. The breach used a poisoned update to the LiteLLM Python library (95 million downloads). Stolen data includes passport scans, Social Security numbers, video interviews and 939 GB of source code. Mercor confirmed the breach; Meta immediately suspended all AI training work with the company. The data appeared for sale on dark web forums in August 2026.
How It Happened: The LiteLLM Supply Chain Attack
On March 27, 2026, threat group TeamPCP uploaded two malicious updates to the LiteLLM library on PyPI — a key Python package repository (versions 1.82.7 and 1.82.8). LiteLLM is a unified AI gateway used to interface with OpenAI, Anthropic, Google, and other AI providers, with over 95 million downloads.
The malicious packages remained live for approximately 40 minutes before being removed. That window was enough to compromise Mercor's infrastructure. On March 31, 2026, Mercor confirmed the breach. This is a textbook software supply chain attack: rather than attacking a well-defended target directly, the attacker poisons a trusted tool the target depends on.
What Was Stolen: 4 TB of Sensitive Data
According to researchers at Cybernews and HackRead who analyzed data samples:
- 939 GB — platform source code;
- 211 GB — user database: candidate profiles, credentials, and assigned roles;
- ~3 TB — storage buckets with video interviews, passport scans, Social Security numbers, and identity verification documents for AI contractors.
In late August 2026, hackers listed the archive for sale on an underground forum. Samples reviewed by SecurityLab.ru and Cybernews were assessed as authentic. Meta responded immediately with an indefinite suspension of all AI data training work involving Mercor.
Why AI Contractors Are the New Target
Mercor is not a standard recruiting agency. The company recruits, vets, and pays the specialists who train large language models for OpenAI, Anthropic, Google, and Meta. Its databases hold records tied directly to the people building some of the world's most sensitive AI systems.
The LiteLLM attack exposed a structural vulnerability: the AI giants themselves may have strong defenses, but their contractors often do not. One malicious package in an open repository, available for 40 minutes, was enough to exfiltrate terabytes of data without ever directly attacking any of the AI companies involved.
What This Means for Everyone
Even users outside the AI industry should pay attention to this incident:
- Document scans and biometrics. Passport scans and SSNs in criminal hands enable identity theft, synthetic fraud, and fake credit applications.
- Video interviews. Combined with AI voice cloning tools, this material can power deepfake social engineering attacks — convincing impersonation using the victim's real face and voice from hiring recordings.
- A blueprint for future attacks. A successful PyPI poisoning sets a template. The next wave will actively target developers who rely on AI libraries — a rapidly growing population.
How to Reduce Your Exposure
Security specialists recommend several practical measures:
- Audit your dependencies before installation. An unusual version bump on a popular package at an unexpected time is a red flag. Tools like pip-audit and Sigstore help detect tampering before it reaches your environment.
- Limit how many platforms receive your biometric data and identity documents. Every platform is a potential point of failure in your personal data supply chain.
- Use LiMP VPN when accessing work platforms over public networks — session hijacking on public Wi-Fi can expose authorization tokens without ever touching a company's own servers.
- Enable two-factor authentication on all professional platforms that hold your employment or personal data.