Mercor Says It Was Affected by LiteLLM Supply-Chain Compromise
Summary
Mercor says it was among thousands of companies affected by malicious code in a LiteLLM package. The incident is linked to TeamPCP, while Lapsus$ separately claimed access to Mercor data; the scope and any exposure remain unclear.
Key points
- Mercor said it was one of thousands of companies affected by the LiteLLM compromise.
- Malicious code was discovered in a LiteLLM package; the issue was reportedly addressed within hours of detection.
- The incident has been linked to TeamPCP, while Lapsus$ separately claimed it accessed Mercor data; how the claims relate remains unclear.
- Mercor says it acted promptly to contain the issue and is investigating with third-party forensics experts.
- The article says LiteLLM is downloaded millions of times daily, raising the potential for broad supply-chain impact.
Article Details
- Victim Organization
- Mercor
- Incident Type
- Software supply chain compromise involving malicious code in a LiteLLM package; Mercor reported that it was affected.
- Affected Records
- Not disclosed. Mercor said it was one of thousands of companies affected by the compromise, but no Mercor-specific record count was provided.
- Affected Data Size
- Not disclosed.
- Operational Impact
- Mercor said it moved promptly to contain the issue and is investigating with third-party forensics experts. No specific operational disruption was reported; whether Mercor data was exposed remains unclear.
- Ransom Or Extortion
- Lapsus$ claimed responsibility for targeting Mercor and accessing its data. The article does not report a ransom demand, and the claim and any connection to the LiteLLM compromise remain unclear.
- Claim Status
- confirmed
People
Threat Actors
LAPSUS$The extortion-focused hacking group claimed responsibility for targeting Mercor and accessing its data. The article says it remains unclear how the group obtained the information or whether it used the LiteLLM compromise.TeamPCPThe LiteLLM supply chain compromise affecting Mercor was attributed to TeamPCP in the article.