Mercor data breach: the LiteLLM malware, and experts' records downloaded in March 2026

Date	Event
March 24, 2026, 10:39 UTC	Malicious LiteLLM versions 1.82.7 and 1.82.8 published to PyPI, quarantined the same day
March 24 to 30, 2026	Unauthorized access to some of Mercor's systems
Early April 2026	Mercor emails affected experts about the investigation
June 25, 2026	Letters; report to Massachusetts (2026-1030): 778 residents
October 1, 2026	Enrollment deadline for TransUnion monitoring

What happened at Mercor?

Mercor's letter tells experts that in late March, LiteLLM disclosed that an unauthorized actor had put malware into certain versions of what the letter calls its widely used code scanning tool. Mercor used it, and the malware let the actor into some of Mercor's systems for about a week. Mercor says it detected and blocked the activity and worked with third-party security experts. Once it confirmed that data had been downloaded, it reviewed the data to find whose personal information was in it, a process it calls time-consuming.

What was the LiteLLM supply chain attack?

LiteLLM's own advisory describes it. The compromised packages were litellm 1.82.7 and 1.82.8 on PyPI, live on March 24, 2026 from 10:39 UTC for about 40 minutes before PyPI quarantined them. LiteLLM believes the compromise came from the Trivy dependency used in its CI/CD security scanning workflow. The letter's "code scanning tool" wording and LiteLLM's account differ: in LiteLLM's account, a scanner in its build pipeline was the way in, and the LiteLLM package carried the malware.

The NHS England cyber security operations centre's alert describes LiteLLM as a widely used API gateway that lets developers reach hundreds of large language models. It says the malicious versions could pull secrets off an affected machine and install persistence that survives a reboot. The code ran on every Python start in an environment where the package was installed, even if LiteLLM was never imported. The documents do not say which Mercor system installed it.

LiteLLM says customers running its official Proxy Docker image were not affected, because that image pins its dependencies. A clean release, v1.83.0, followed on March 30.

What information was exposed?

The letter fills in the data per person, and the filed sample leaves that field blank. Massachusetts marks Social Security numbers and driver's licenses for its 778 residents, and no medical records, financial accounts or cards. The letter does not say how many experts were notified in total.

Record	People	Data it marks
Massachusetts OCABR, report 2026-1030	778	Social Security numbers, driver's licenses

What is Mercor offering?

Twenty-four months of TransUnion credit monitoring and identity restoration, with an enrollment deadline of October 1, 2026. That date has passed. A credit freeze at the three bureaus still works at any time. The call center, 1-844-507-8047, is open 8 a.m. to 8 p.m. Eastern, Monday to Friday. For other incidents that came in through software suppliers, see the vendor and cloud tenant guide. For letters from a company you only worked for as a contractor, see the guide to letters from a company you never dealt with.

What the documents leave open

• Which Mercor system ran the compromised LiteLLM version, and which credentials the malware took.
• How many experts were notified across all states.
• Who was behind the LiteLLM compromise; the advisories link it to the Trivy compromise but name no one.