OpenAI, Anthropic contractor Mercor targeted in major security breach — what data was stolen, who carried out the hack?

Mercor, a $10 billion AI startup that provides data to major AI firms including OpenAI and Anthropic, has confirmed that it was hit by a security breach that may have exposed sensitive company and user data.

The security incident was linked to a supply chain attack involving an open source project named LiteLLM, and Mercor on Tuesday confirmed to TechCrunch that it was "one of the thousands of companies" that had been affected by the compromise of LiteLLM's security.

While the LiteLLM breach was linked to a hacking group called TeamPCP, another group called Lapsus$, known for extorting victims, claimed to have targeted Mercor.

It was not immediately clear how Lapsus$ got the stolen Mercor data, and whether it participated in TeamPCP's cyberattack, reported TechCrunch.

TeamPCP reportedly targeted the tool, planting malicious code inside LiteLLM to extract and harvest credentials.

Although the malicious code implanted by TeamPCP was identified and removed within hours, it had spread widely in the industry.

Lapsus$ also claimed responsibility for the breach on its leak site, sharing a sample of data allegedly taken from Mercor. The sample included material that referenced data from Slack, a commonly used workplace communications app, as well as ticketing data, reported TechCrunch. It further included two videos purportedly showing conversations between the Silicon Valley startup's AI systems and contractors on its platform.

TeamPCP, which carried out the cyberattack against LiteLLM, has a reputation for engineering so-called supply chain attacks that target software libraries widely used by developers when writing their own code.

Lapsus$, meanwhile, is an older cybercrime group known for social engineering and phishing attacks that target log-in credentials to access and steal sensitive data. The group is also notorious for extorting its victims.

"The privacy and security of our customers and contractors is foundational to everything we do at Mercor," Hagburg said, adding, "We will continue to communicate with our customers and contractors directly as appropriate and devote the resources necessary to resolving the matter as soon as possible."

However, Hagberg did not comment on whether the incident was linked to claims by Lapsus$, or whether the data of customers and contractors had been accessed and misused.

It also remains unclear how many companies were affected by the LiteLLM-related data breach.

In October 2025, Mercor raised $350 million in a Series C funding round led by Felicis Ventures in October 2025, and was valued at $10 billion.