Mercor Data Breach
The 2026 Mercor data breach involved unauthorized access to company systems after malware was inserted into certain versions of a LiteLLM tool used by the company.
This classification is based on a reviewed lower bound; the actual impact and severity may be higher.
Exposed Data Types
6- Names
- Physical addresses
- Dates of birth
- Social security numbers
- Driver's license numbers
- Government IDs
About This Breach
A Texas regulator record confirms that at least 2,025 people were affected; the nationwide total has not been disclosed.
Mercor.io Corporation is a U.S. work platform connecting professionals with artificial-intelligence projects. The incident was a software supply-chain attack that reached company systems through a tool used by the platform.
How Did the Incident Occur?
In late March 2026, LiteLLM disclosed that an unauthorized actor had inserted malware into certain versions of a widely used code-scanning tool. Mercor was one of the organizations using the tool, and the malware enabled access to some Mercor systems between March 24 and March 30. The company detected and blocked the activity and began reviewing the downloaded data.
What Information Was Affected?
According to the Texas record, the information could have included names, addresses, dates of birth, Social Security numbers, driver's licenses, and government identification such as passports or state IDs, depending on the person. The person-specific field is redacted in the public sample notice, so no broader data category has been added.
How Did Mercor Respond?
The company detected and blocked the unauthorized activity, investigated with external security specialists, and enhanced its security and monitoring controls. Notice recipients were offered 24 months of credit monitoring and identity-restoration support.
What Should Affected People Do?
Notice recipients should review credit reports and financial accounts for unfamiliar activity. People whose Social Security or government-ID information was involved may consider a credit freeze or fraud alert. Unexpected messages sent in Mercor's name or referring to a work opportunity should be verified through the platform's known official channels.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
