$10B AI Darling Mercor Hit by 4-Terabyte Hack, Exposing Biometrics and SSNs After LiteLLM Breach. How to Protect Yourself

AI hiring platform Mercor has officially completed a third-party forensic investigation into a March 2026 supply chain cyberattack, confirming that hackers successfully exfiltrated sensitive user data.^[1]

The breach occurred between March 24 and March 30, 2026, stemming from a malicious update injected into LiteLLM, a popular open-source tool used widely across the AI sector.

While Mercor stated that the breach affected only a "very limited subset" of its nearly five million experts, independent cybersecurity reports and active class-action lawsuits indicate that approximately four terabytes of data — impacting over 40,000 contractors — were stolen.

Here's what was taken, why this breach is harder to shake than most, and what to do if you received a notification.

Thanks for subscribing!

Please check your email for your first message.

Take back control of your privacy.

Join thousands who get our privacy-first newsletter every week. No spam. No nonsense.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

Delayed notifications and independent findings

Though the attack took place in late March, the startup waited roughly three months to notify users, sending out official data breach notices on June 25 and 26.

Mercor defended the timeline, stating it delayed disclosure to allow third-party forensic firms Mandiant and Latacora, alongside law enforcement, to accurately map the damage.

However, the three-month delay has already sparked major legal blowback. A putative class-action lawsuit filed in California, Ananthula v. Mercor.io Corp, alleges the company failed to maintain adequate cybersecurity. At least seven suits have now been filed in federal courts in California and Texas.

While Mercor's official update maintains there is "no evidence that any of this data has been used fraudulently," cybersecurity firms have tracked the stolen cache being shopped around dark web forums. Extortion hacking group Lapsus$, which claimed responsibility for the breach, listed the stolen cache on dark web forums and began auctioning it to potential buyers.

What the hackers took

According to Mercor’s official post, no employee data was affected, and the customer impact was minimal because clients operate on their own isolated infrastructure.

For the impacted contractors, however, the stolen 4-terabyte haul goes far beyond basic contact information. According to court filings, the compromised data includes:

• Government identification, including passport and driver's license scans
• Tax information, including SSNs and W-9 forms
• Biometric data, including over 3 terabytes worth of AI video interviews and facial biometrics
• Proprietary infrastructure, including source code and cloud API keys

The company said it began notifying affected individuals on June 25 and June 26 from mercor@notifications.cyberscout.com, with emails detailing what information was involved and offering complimentary TransUnion identity protection services.

What Mercor told affected users

The notification email, titled Notice of Data Breach, provides additional detail about the incident and confirms attackers had access to some Mercor systems between March 24 and March 30.

"The malware enabled the unauthorized actor to access some of our systems between March 24-30, 2026. We quickly detected and blocked the activity while working with third-party security experts to investigate what happened and further strengthen our security."

"Following the investigation, we determined that your contact information were downloaded by the threat actor," they added.

What Mercor is doing now

Mercor says it has strengthened its security since the incident by:

• Auditing all third-party software dependencies
• Rotating credentials and access keys across cloud platforms, GitHub, and SaaS systems
• Tightening cloud security policies and network controls
• Expanding independent penetration testing
• Implementing 24/7 managed detection and response

The company said it will continue investing in additional safeguards and monitoring to help prevent similar incidents in the future.

If you receive an email from mercor@notifications.cyberscout.com, it's worth reading carefully to determine whether your information was involved and to take advantage of any identity protection services being offered.

What to do if you got a Mercor breach notice

If you receive a notification from Mercor, don't ignore it. 

1. Enroll in the free identity protection. Mercor is offering complimentary identity protection services to affected individuals, with enrollment instructions in the notification email. Do it even if nothing looks suspicious yet. Monitoring works best when it starts early.
2. Pull your credit reports. Request copies of your credit reports from all three major bureaus and look for accounts, inquiries, or activity you don't recognize.
3. Consider a fraud alert or credit freeze. If your SSN or government ID was exposed, a fraud alert requires lenders to verify your identity before opening new accounts in your name. A credit freeze goes further by blocking new credit applications entirely until you lift it. 
4. Watch for targeted phishing. The stolen data includes your name, job history, contact information, and recorded interview footage. That's enough for follow-up scams to look unusually convincing. Be skeptical of any unexpected emails or calls claiming to be from Mercor, TransUnion, or a financial institution.
5. Keep a record. Log any suspicious activity, phishing attempts, and time you spend on remediation. This matters if you join a class action or file a complaint with the FTC.

Bottom line

Mercor confirmed that a March 2026 supply chain attack exposed passport scans, Social Security numbers, facial biometrics, and video interview recordings belonging to a subset of its nearly five million contractors — and the company waited three months to say so.

If you worked with Mercor and received a notice, enroll in the offered identity protection, consider placing a fraud alert or freeze on your credit, and stay alert for targeted phishing. The stolen data is personal enough that follow-up scams could be convincing.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Get Deal

On Aura Identity Theft's website

2026 Editors’ Choice

Best Overall Identity Theft Protection Service

Identity Protection

Aura Identity Theft

PROMOTION: Save Up to 68%

• ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
• Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
• Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.