Meta Halts Mercor Work After Data Breach

Enhanced Key Takeaways

• •The breach originated from a supply chain attack on the open-source LiteLLM library, where threat actor TeamPCP injected a malicious backdoor into versions 1.82.7 and 1.82.8 to harvest credentials.
• •The hacking group Lapsus$ has claimed responsibility for exfiltrating 4TB of Mercor data, including source code, internal databases, Slack communications, and sensitive KYC/identity verification documents.
• •Mercor, a $10 billion valuation startup, serves as a critical infrastructure provider for AI labs by managing a network of over 30,000 expert contractors used for model evaluation and training.

Technical Deep Dive

• •Attack Vector: Supply chain compromise of the LiteLLM Python library via unauthorized PyPI package publishing.
• •Malware Mechanism: Three-stage malicious backdoor designed for credential harvesting and establishing persistent system access.
• •Exfiltrated Data: Allegedly includes 939GB of source code, a 211GB user database, and 3TB of storage buckets containing video interviews and identity verification passports.
• •Infrastructure Impact: Attackers reportedly leveraged access to the company's Tailscale VPN to facilitate the large-scale data exfiltration.

Future ImplicationsAI analysis grounded in cited sources

Timeline