---
title: AI Recruiting Firm Mercor Hit by Major Supply Chain Attack
description: AI startup Mercor hit by supply chain attack via LiteLLM library; data breach includes 4TB of sensitive information now being auctioned.
canonical_url: https://codekeeper.co/ticker/mercor-supply-chain-attack-data-breach
---

# AI Recruiting Firm Mercor Hit by Major Supply Chain Attack

AI startup Mercor hit by supply chain attack via LiteLLM library; data breach includes 4TB of sensitive information now being auctioned.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Apr 2, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

AI recruiting startup Mercor was caught up in a massive supply chain attack that compromised thousands of companies through the popular LiteLLM library. The attack began March 27 when hackers from TeamPCP used stolen credentials to publish malicious versions of LiteLLM on PyPI for 40 minutes. The Lapsus$ extortion group now claims to have stolen over 4 terabytes of Mercor's data, including candidate profiles, personal information, employer data, video interviews, source code, and VPN credentials. They're reportedly auctioning this information online. Mercor says it's working with forensics experts to investigate the breach, but hasn't confirmed the extent of the data theft. **Source:** [Security Week](https://www.securityweek.com/mercor-hit-by-litellm-supply-chain-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmercor-supply-chain-attack-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Ransomware Gunra Ransomware Gang Exploits Fortinet Flaws and Bypasses MFA in Global Attacks Aug 14, 2026](https://codekeeper.co/ticker/gunra-ransomware-threatens-global-infrastructure)

[Japan's Military Unknowingly Used Chinese Malware-Infected USB Drives for Nearly a Year Aug 12, 2026](https://codekeeper.co/ticker/jgsdf-malware-infected-usb-drives-expose-classified-data)

[CISA Flags Actively Exploited Linux Kernel Vulnerability Aug 12, 2026](https://codekeeper.co/ticker/cisa-adds-cve-2022-0492-to-vulnerability-catalog)

[Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack Aug 11, 2026](https://codekeeper.co/ticker/coca-cola-fairlife-ransomware-data-breach)