Mercor.io (LiteLLM) data breach

Clerk's notes

Mercor.io, the operator of the LiteLLM platform, formally reported a security incident to the Washington Attorney General on June 26, 2026. This breach, which is currently being monitored, impacts a company operating at the intersection of AI development and enterprise data processing, suggesting potential exposure of critical digital infrastructure elements.

As a platform facilitating large language model integration and API routing, Mercor.io handles significant volumes of corporate data and developer credentials. Security incidents involving such platforms often stem from sophisticated cyberattacks, including unauthorized access to cloud databases, compromised API endpoints, or vulnerabilities within the software supply chain. An intrusion into a service layer like LiteLLM can provide malicious actors with deep visibility into underlying data streams.

The exposed data categories identified in this incident include Full Name, Email Address, Password or Credential Hash, API Keys and Access Tokens, Administrative Credentials, Mailing Address, Internal System Logs, and Payment Card Information. The compromise of API keys and credential hashes poses severe downstream security risks, potentially allowing unauthorized access to corporate accounts, cloud environments, or financial transactions. Additionally, exposed administrative credentials can lead to secondary attacks or corporate espionage.

Operating in Washington state and processing enterprise digital assets, Mercor.io is obligated to maintain robust cybersecurity measures under statutory and common-law duties of care. The Washington Data Breach Notification Act, alongside federal regulations, requires technology platforms to implement reasonable security safeguards. The occurrence of a data breach like this suggests that systemic security failures may have taken place, potentially indicating a failure to protect sensitive digital infrastructure from foreseeable threats.

If you have received a data breach notification letter from Mercor.io, it signifies that your confidential information or account credentials were potentially compromised. This notification establishes the basis for individuals to seek legal redress. Victims are not required to prove financial fraud to pursue a claim; the increased risk of identity theft, system compromise, and the necessary efforts to restore security are considered actionable harms. Our firm is currently investigating potential class action claims related to this incident. There are no out-of-pocket costs for a review of your situation.

If a notification letter about this breach reached you, see every Washington data breach on file or browse all cases.