Mercor Investigates Unverified Claim of 4TB Data Theft
Summary
Cybernews assessed samples linked to an alleged Mercor data theft as credible, but the 4TB claim remains unverified and Mercor has not publicly confirmed a new breach. Its possible connection to an earlier LiteLLM incident is unknown.
Key points
- Cybercrime forum sellers claim to have stolen 4TB of Mercor data; the claim has not been independently confirmed.
- Cybernews analyzed sample data and reported finding activity logs, AI prompts, credentials, role assignments, hiring information, and candidate data.
- Exposed credentials and role information could support targeted phishing, impersonation, or identity theft, according to the article.
- Mercor has not formally confirmed the newly alleged intrusion.
- The claimed 4TB volume matches the amount associated with a previously reported incident, but the article says this does not establish that the datasets are the same.
- Mercor previously disclosed a supply-chain compromise involving a malicious LiteLLM package in March 2026.
Article Details
- Victim Organization
- Mercor
- Incident Type
- Alleged data breach and exfiltration; sellers claimed they stole data, but the new incident remains unverified.
- Disclosure Date
- 2026-08-27
- Data Types Exposed
- User activity logs
- Proprietary AI prompts
- Account credentials
- Organizational role assignments
- Confidential hiring activities
- Candidate personal information
- Proprietary source code
- Affected Data Size
- Sellers claimed 4 terabytes; this volume is unverified.
- Operational Impact
- No operational impact from the newly alleged incident was confirmed.
- Ransom Or Extortion
- No ransom demand or extortion activity was reported. Sellers advertised the alleged stolen data on an underground forum.
- Claim Status
- claimed