4TB of Data Leaked Overnight: How Did an AI Recruitment Startup Valued at 10 Billion Get Compromised by a Compromised Supply Chain?

A Look Back at the Incident: 4 TB of Data Leaked onto the Dark Web Overnight

Mercor’s core business is connecting experts in various fields—such as doctors, lawyers, and engineers—to provide “human feedback” to leading AI companies—that is, data annotation, evaluation, and RLHF (reinforcement learning from human feedback) tasks required for training models. It claims to have a network of over 300,000A professional network where contractors are paid up to $1.5 million. This means that its servers are filled with the very things other AI companies are most reluctant to have leaked: training instructions, fine-tuning strategies, evaluation metrics, and the identities and biometric data of tens of thousands of experts.

On March 24, 2026, Mercor was compromised after installing an open-source package that had been tampered with. By the end of March, the hacker group LAPSUS$ Posted their haul on their own leak site, claiming to have stolen approximately 4 TB data, and released some samples. According to a cross-check by cybersecurity firms and court documents, this data is broadly divided into three categories:

• 939GB Platform Source Code: Includes Mercor’s core matching algorithm, internal dashboard, evaluation tools, and embedded API keys and service credentials;

• 211 GB User Database: More than 40,000The contractor's name, email address, work history, Social Security number (SSN), and contact information;

• A storage bucket of nearly 3 TB: Thousands of hours of video interview recordings, copies of passports and driver's licenses, as well as facial and voice biometric data, etc.Biometric Characteristics。

What has the cybersecurity community most concerned is the combination of “video interviews and ID documents.” These recordings document how real people solve problems and respond to professional scenarios. If leaked, this content could not only be used to impersonate others or apply for loans, but could also be reverse-engineered to reveal the training methods commissioned by OpenAI and Meta—a “trade secret” worth billions of dollars.

Meta's response was the most immediate: it announced right away that it was suspending all cooperation with Mercor indefinitely.. OpenAI said it is investigating the extent of its exposure, while Anthropic has remained silent. As for Mercor itself, it did not publicly confirm the hack until March 31, but delayed June 25The company has just submitted a data breach notification to the California Attorney General—a full three months late—and is now facing questions about whether it may have violated reporting obligations under state and federal law.

As of now, there have been at least 7 casesA class-action lawsuit has been filed against Mercor, alleging basic lapses such as “failing to enable multi-factor authentication (MFA)” and “failing to encrypt at-rest data.” Mercor is offering affected individuals 24 months of free credit monitoring as compensation.

Analysis of the Causes: The real problem does not lie with Mercor itself

The most ironic—and most alarming—aspect of this incident is that—The hackers didn't launch a direct attack on Mercor at all.。

The attack originated from an open-source AI gateway library used by Mercor. LiteLLM. Hacker group TeamPCP First, they hacked an open-source vulnerability scanner Trivy(Produced by Aqua Security), the attackers stole the CI/CD release credentials, then followed the trail to obtain the PyPI credentials of the LiteLLM maintainer, and finally released two versions containing backdoors on March 24. Mercor’s automated processes unwittingly introduced this “poisoned seed” into its own environment.

As soon as the backdoor is executed, it immediately scans for various credentials in the environment variables, allowing the attacker to gain access to Mercor's Tailscale VPN Full control—equivalent to obtaining a “golden ticket” that allows the attacker to masquerade as a trusted internal machine. From that point on, the entire internal network map, backend systems, and source code repositories are laid bare before the attacker.

The entire chain reveals a brutal division of labor:TeamPCP is in charge of "breaking in," while LAPSUS$ is in charge of "carrying the loot and showing it off.". And Mercor is just the most prominent company to be affected along this supply chain.

Prevention Tips: Treat "Suppliers" as Your Own Security Perimeter

Lessons for Businesses...goes far deeper than a single event:

1. Treat third-party software as part of your own attack surface: The vulnerability in Mercor originated from an external library. Organizations must create a “software bill of materials” (SBOM) for open-source packages, pin versions, enable supply chain scanning, and perform integrity checks on any automatic package upgrades.

1. Minimize Outsourced Data: AI companies frequently outsource large volumes of training data, annotation processes, and fine-tuning methods to vendors, yet often fail to implement safeguards regarding those vendors’ information security standards. It is essential to provide only “the minimum amount of data necessary to complete the task” and to clearly stipulate data classification and destruction obligations in the contract.

1. Enable the most basic line of defense: MFA, static data encryption, centralized key management—these “basic measures” cited in the lawsuit are precisely the steps most often overlooked by fast-growing startups.

1. Reports Should Not Be Delayed: Failing to issue a public notice until three months after a data breach occurs will only exacerbate legal and reputational risks. Establishing a clear timeline for reporting cybersecurity incidents is the final safeguard for compliance.

Reminders for IndividualsTo put it more simply: If you’ve ever taken on freelance work through platforms like Mercor, uploaded a copy of your passport, or recorded a video interview, be sure to watch closely for signs of identity theft, freeze any unnecessary credit inquiries, and be on the lookout for any unknown calls or text messages claiming to be “verifying your identity.”

Conclusion

The story of Mercor is the perfect illustration of how the AI security landscape shifted in 2026: as the most valuable assets shifted from “code” to “data and methodology,” risks expanded from “behind the company’s firewall” to “the entire supply chain.” A company that helped AI giants vet talent ultimately became the very vulnerability through which their trade secrets were leaked.

Before you hand over your core data to any partner, ask yourself: Is the supply chain behind it truly secure?

References

• Cybernews: “Hackers Claim to Have Stolen 4TB of Data from an AI Firm Serving OpenAI, Google, and Meta”

• Cyber Security News: “Mercor AI Confirms Data Breach Following Lapsus$ Claims of 4TB Data Theft”

• Almeida Law Group: “Mercor.io Corporation Data Breach Investigation”

• PR Newswire: “PRIVACY ALERT: Mercor.io Corporation Under Investigation for Data Breach”

• TechStartups: “Mercor Confirms Breach in LiteLLM Supply-Chain Attack, Exposing 4TB of Candidate Data and Source Code”

Leveraging Digital Vaults to Strengthen AI Supply Chain and Confidentiality Security Defenses

In the age of artificial intelligence, cybersecurity can no longer focus solely on internally developed systems. Every library, software package, SDK, model provider, plugin, and third-party service related to development and the AI ecosystem has the potential to become part of an organization’s attack surface.

Digital Vault Committed to providing full-lifecycleSecret Management, Dynamic Key Rotation, and AI Supply Chain Risk Management

Before risks are exploited as attack vectors, understand them and, through Digital Vault Strengthen the security of your digital and AI supply chains.

Contact us:www.sest.com.hk | info@sest.com.hk