AI Recruiting Startup Mercor Hit by Cyberattack Linked to LiteLLM Open-Source Compromise

AI recruiting startup Mercor, valued at $10 billion following a $350 million Series C in October 2025, confirmed a security incident linked to a supply chain attack on the open-source LiteLLM project that affected thousands of companies. Extortion group Lapsus$ claimed responsibility for targeting Mercor specifically, sharing sample data including Slack references and videos allegedly showing contractor conversations on Mercor's platform. The LiteLLM compromise, attributed to hacking group TeamPCP, involved malicious code in the Y Combinator-backed project's package that was removed within hours of discovery. Mercor, which works with OpenAI and Anthropic and facilitates over $2 million in daily payouts to contractors including specialized experts from India, declined to confirm whether customer or contractor data was accessed while conducting forensic investigation.

Mercor cyberattack and data breach claims

• ▪Extortion hacking group Lapsus$ claimed it had targeted Mercor and gained access to Mercor's data
• ▪Mercor stated it was one of thousands of companies affected by the LiteLLM compromise
• ▪Mercor spokesperson Heidi Hagberg declined to answer whether any customer or contractor data had been accessed, exfiltrated, or misused
• ▪Mercor spokesperson Heidi Hagberg confirmed Mercor moved promptly to contain and remediate the security incident
• ▪Mercor confirmed a security incident linked to a supply chain attack involving the open-source project LiteLLM
• ▪Mercor is conducting a thorough investigation supported by leading third-party forensics experts

LiteLLM open-source supply chain compromise

• ▪Malicious code was discovered in a package associated with the Y Combinator-backed LiteLLM's open-source project
• ▪The malicious code in LiteLLM was identified and removed within hours
• ▪The LiteLLM compromise was linked to a hacking group called TeamPCP
• ▪The number of companies affected by the LiteLLM-related incident remains unclear as investigations continue
• ▪The LiteLLM library is downloaded millions of times per day according to security firm Snyk
• ▪LiteLLM shifted from startup Delve to Vanta for compliance certifications following the incident

Mercor's business operations and market position

• ▪Mercor facilitates more than $2 million in daily payouts
• ▪Mercor works with companies including OpenAI and Anthropic to train AI models
• ▪Mercor contracts specialized domain experts such as scientists, doctors, and lawyers from markets including India
• ▪Mercor was valued at $10 billion following a $350 million Series C round led by Felicis Ventures in October 2025

Perspective of Open-source security community

• ▪The LiteLLM incident demonstrates the risk exposure created when open-source libraries are downloaded millions of times per day