Mercor, a prominent AI recruiting startup, has acknowledged a security breach connected to a supply chain attack involving the open-source project LiteLLM.
The AI startup informed TechCrunch on Tuesday that it was among “thousands of companies” impacted by a recent compromise of LiteLLM’s project, which was attributed to a hacking collective known as TeamPCP. This confirmation follows claims by the extortion hacking group Lapsus$ that they had targeted Mercor and obtained access to its data.
The method by which the Lapsus$ gang acquired Mercor’s stolen data in connection with TeamPCP’s cyberattack remains unclear at this time.
Established in 2023, Mercor collaborates with companies such as OpenAI and Anthropic to train AI models by hiring specialized domain experts, including scientists, doctors, and lawyers, from markets like India. The startup claims to process over $2 million in daily payments and was valued at $10 billion after a $350 million Series C funding round led by Felicis Ventures in October 2025.
Mercor spokesperson Heidi Hagberg confirmed to TechCrunch that the company had “acted quickly” to contain and resolve the security incident.
“We are conducting a thorough investigation, supported by leading third-party forensics experts,” Hagberg stated. “We will continue to communicate with our customers and contractors directly as appropriate and dedicate the necessary resources to resolve the matter as soon as possible.”
Previously, Lapsus$ claimed responsibility for the alleged data breach on its leak site and shared a data sample purportedly taken from Mercor, which TechCrunch reviewed. The sample contained material referencing Slack data, what appeared to be ticketing information, and two videos allegedly showing conversations between Mercor’s AI systems and contractors on its platform.
Hagberg declined to answer additional questions regarding whether the incident was related to Lapsus$’s claims, or if any customer or contractor data had been accessed, exfiltrated, or misused.
The compromise of LiteLLM first came to light last week after malicious code was found in a package associated with the Y Combinator-backed startup’s open-source project. Although the malicious code was identified and removed within hours, the incident attracted attention due to LiteLLM’s widespread use online, with the library being downloaded millions of times daily, according to security firm Snyk. The incident also prompted LiteLLM to modify its compliance processes, including transitioning from the controversial startup Delve to Vanta for compliance certifications.
The total number of companies affected by the LiteLLM-related incident and whether any data exposure occurred remain unclear as investigations are ongoing.