On March 27, 2026, a threat group known as TeamPCP used compromised maintainer credentials to publish two malicious LiteLLM versions to PyPI: 1.82.7 and 1.82.8. The packages were live for roughly forty minutes before being pulled. That is not an unusually long window by open-source standards, but LiteLLM is not an unusually small package. According to Wiz Research, LiteLLM is present in roughly 36% of cloud environments, and Cybernews puts its monthly download volume near 97 million.

The malicious versions were designed to exfiltrate credentials from any system that installed them. LiteLLM’s own postmortem traces the root cause one step further back, to a separate compromise of a scanning tool called Trivy that had exposed sensitive tokens used in the LiteLLM CI/CD workflow. In other words: the poisoning of LiteLLM was itself the downstream result of a supply chain attack on the supply chain of LiteLLM.

The pattern will feel familiar to anyone who tracked log4j in December 2021. A single piece of shared infrastructure, so common it stops registering as a third-party dependency at all, becomes the highest-leverage target on the internet for a short window. LiteLLM in 2026 sits in the same category as log4j did then. It is glue code that connects application layers to LLM providers, and once it is installed, it sits deep inside CI/CD and runtime environments where credentials and tokens live. A poisoned version can silently pull whatever the surrounding process can reach.

Within days of Mercor’s short March 31 disclosure, the Lapsus$ extortion group added Mercor to its dark-web leak site and claimed to hold approximately 4 terabytes of internal data. The listing detailed candidate profiles, personally identifiable information, employer data, user accounts and credentials, video interviews, proprietary information, source code, API keys and secrets, and TailScale VPN records.

SecurityWeek reported that TeamPCP, the group behind the LiteLLM compromise, is believed to have partnered with Lapsus$ to monetize the access. This is a meaningful pattern change. Historically, Lapsus$ was best known for the 2022 attacks on Okta, Microsoft, Nvidia, and Samsung. TeamPCP has been more focused on open-source and cloud infrastructure. A collaboration between an infrastructure-focused compromise group and an established extortion brand is exactly the kind of vertical integration that made ShinyHunters’ Salesforce campaign so damaging and Cl0p’s MOVEit campaign so lucrative.

Mercor has neither confirmed nor denied the authenticity of the 4TB figure. Independent reporting from AllAboutCookies and Business Insider indicates roughly 40,000 contractors received breach notifications, a scale that is inconsistent with the “very limited subset” framing used in Mercor’s early public messaging. Whether the auction actually cleared, and to whom, is not publicly known. What is publicly known is that samples were posted to establish credibility, and those samples matched categories subsequently confirmed in the contractor notification emails.

Sources told Wired in early April that Meta had paused its Mercor contracts indefinitely. Mercor declined to comment. That decision matters more than it looks: Meta spent $14.3 billion on Mercor’s competitor Scale AI and still continued working with Mercor, because Mercor’s specialty is not raw labeling volume but access to domain experts, doctors, lawyers, and PhDs used to train reasoning-heavy models for OpenAI, Anthropic, Google, and Meta itself.

For a company reportedly on pace to hit over $1 billion in annualized revenue earlier in the year, per The Information, losing an anchor customer is a real revenue event, not a headline event. And Meta was almost certainly not alone in reviewing its exposure. Lab customers with SEC disclosure obligations, Microsoft, Google’s Alphabet, and Meta itself, had to privately determine whether evaluator metadata, rubrics, or program correspondence in Mercor’s environment qualifies as material under the SEC’s 2023 cybersecurity disclosure rules.

Mercor’s business model is what makes the Meta pause so consequential. The company was founded in 2023 by Brendan Foody, Adarsh Hiremath, and Surya Midha, all in their early twenties, and raised its $350 million Series C in October 2025 at a $10 billion valuation, led by Felicis Ventures. The pitch is that as frontier labs shifted from broad labeling to specialized reasoning training, they needed vetted domain experts on lab timelines, not gig-economy volume. Mercor operates a platform of roughly five million registered experts and moves them through video interviews, background checks, and NDA workflows before assigning them to lab projects. The vetting stack is exactly what got exfiltrated.

One of the five contractor lawsuits reviewed by TechCrunch named LiteLLM and Delve, an AI compliance startup, as co-defendants. The connection is that LiteLLM had used Delve to obtain its security certifications. Around the same time, an anonymous whistleblower accused Delve of allegedly faking data for those certifications and using rubber-stamping auditors. Delve denied the allegations while instituting operational changes, but by early April the reputational damage had begun. Y Combinator cut ties with Delve.

LiteLLM dropped Delve and moved to a different compliance partner. Mercor itself was not a Delve customer, the company confirmed to TechCrunch. But the sequence still lands somewhere uncomfortable for the industry: a widely used open-source AI library was certified through a compliance vendor now accused of rubber-stamping, and that library was then used to attack a startup valued at $10 billion. That is not a story about Delve alone. It is a story about a specific segment of the “AI compliance” market that grew fast in 2024 and 2025 by offering rapid SOC 2, ISO 27001, and HIPAA attestations to AI startups facing enterprise procurement questions for the first time.

The theory tested by the contractor lawsuit is that a compliance vendor that allegedly rubber-stamps controls contributes to downstream harm when those controls fail. Whether that theory survives a motion to dismiss will matter for the whole category. If it does, expect due diligence on compliance vendors themselves to become part of enterprise procurement checklists in a way it currently is not.

Mercor’s March 31 statement acknowledged the LiteLLM incident. Its June 26 blog post announced that the third-party forensic investigation, assisted by Google’s Mandiant and security firm Latacora, was complete. In between, according to AllAboutCookies’ review of notification emails, most affected contractors did not receive individualized breach notices confirming their data had been touched. The notification emails, sent from mercor@notifications.cyberscout.com, arrived at scale roughly three months after the initial exposure window.

For the ~40,000 contractors reportedly notified, that gap has a real cost. During those three months, they could not place fraud alerts, could not freeze credit with specificity, and could not know whether the phishing attempts hitting their inbox were tied to Mercor or ambient noise. The company’s stated position, that most of the data affected was “contact information,” is inconsistent with the passport scans, SSNs, facial biometrics, and video interview recordings cited in independent reporting and in the five contractor lawsuits filed since April.

There is also a regulatory dimension. California’s CCPA, Illinois’ Personal Information Protection Act, New York’s SHIELD Act, and Texas’ identity theft statutes all trigger notification obligations when SSNs are involved. The specific timing rules vary, but “as soon as reasonably possible” is the general standard, and a three-month gap between confirmed exposure and mass notification will invite scrutiny. Affected EU-based contractors have GDPR data-subject rights that force Mercor to disclose precisely what categories of personal data were exfiltrated, on request, within one month. Those DSAR requests are already being filed.