Mercor Data Breach: What Was Exposed and What to Do (2026)

Last updated: October 29, 2026

The Mercor data breach was a cyberattack in late March 2026 that exposed personal information belonging to some of the contractors Mercor hires to train AI models. Attackers got in through malware hidden in LiteLLM, an open-source tool Mercor used, and downloaded data between March 24 and 30.

Mercor sent breach notices on June 25 and 26, 2026. The exposed data included Social Security numbers, ID numbers and dates of birth.

For the bigger picture on Mercor, see our review of whether Mercor is legit. If you’re a business thinking of selling data to Mercor or a company like it, start with our guide to selling your company’s data to AI companies.

Key takeaways

• Attackers were inside some Mercor systems from March 24 to 30, 2026, through two poisoned versions of LiteLLM.
• Exposed data included names, addresses, Social Security numbers, driver’s license and passport numbers, and dates of birth.
• Mercor’s Texas filing counts 2,025 Texans. ClaimDepot’s tally of state filings is 21,677 people in total.
• The free TransUnion credit monitoring had to be activated by October 1, 2026. That deadline has passed.
• Seven California class actions were combined in May 2026 and paused in July for mediation. There’s no settlement yet.

What happened in the Mercor data breach?

A supply chain attack hits a company through software it trusts rather than attacking it directly. In this case, attackers slipped credential-stealing code into LiteLLM versions 1.82.7 and 1.82.8, according to Snyk’s advisory. Any system that installed them could leak passwords, cloud keys and API tokens.

Mercor’s breach notice filed with California’s Attorney General says the malware let the attacker access some of its systems between March 24 and 30, 2026. Mercor says it detected and blocked the activity, then brought in outside security firms. Its June 25 update names Google’s Mandiant and Latacora.

The hacking group Lapsus$ claimed to have taken about 4 TB of Mercor data, Cybernews reported. Mercor hasn’t confirmed that figure.

When did the Mercor breach happen?

What information was exposed?

That list comes from Mercor’s own entry in the Texas Attorney General’s breach database, published June 26, 2026.

Mercor says “no employee data was affected” and that impact to customer information was “very limited.” It hasn’t said what customer data was involved.

How many people were affected?

Mercor’s line is that only a “very limited subset” of its nearly five million experts had sensitive information affected. Even the highest filed figure is under 1% of that pool.

How do I know if I was affected?

Check your spam folder for the notice, since it came from a mass mailing. The letter starts “Valued Expert” and says it’s about “the incident affecting your personal information.”

Be careful with look-alike emails. Breaches are often followed by phishing that copies the real notice. Mercor’s letter asks you to activate monitoring at bfs.cyberscout.com, TransUnion’s site. It doesn’t ask for your password or bank details.

What should you do if your data was exposed?

1. Freeze your credit at all three bureaus. It’s free, and you can lift it when you need to apply for credit.
2. Pull your free credit reports at annualcreditreport.com and look for accounts you don’t recognize.
3. Get an IRS Identity Protection PIN. Your Social Security number is the key to tax refund fraud, and the PIN stops someone else filing in your name.
4. Change your Mercor password and any other account that used the same one.
5. Ignore anyone who contacts you about the breach and asks for personal details. Call Mercor’s number from the letter instead.

The free 24-month TransUnion monitoring Mercor offered had to be activated by October 1, 2026. If you missed it, a credit freeze does more anyway: monitoring tells you after an account is opened, and a freeze stops it being opened.

Is there a Mercor data breach lawsuit or settlement?

The cases were filed between April 1 and April 21, 2026, and all went to Judge William H. Orrick. On May 19 he combined them and named interim lead counsel, and the plaintiffs filed one consolidated complaint on June 18. The court docket shows the stay for mediation on July 21, and no later ruling.

You don’t need to sign up with a law firm to be included. If the case settles, people in the class get a notice explaining how to file a claim. Mercor’s contractor agreement has an arbitration clause, which may affect who can join.

Mercor faces other suits too, including Scale AI’s trade secrets case. Our Mercor review covers those.

Was company data exposed?

Mercor’s business side licenses records from companies and sells them on to AI labs. The breach is the clearest example of why a seller should limit what it sends and get a deletion date in the contract.

Our guide to whether selling company data to AI is safe covers the security questions to ask a buyer. The AI data licensing agreement guide covers breach notice and deletion clauses.

Is Mercor safe to use after the breach?

In its June 25 update, Mercor listed the changes it made: auditing all third-party software, rotating credentials and access keys, tighter cloud and network controls, ongoing penetration testing and round-the-clock monitoring.

The attack wasn’t unique to Mercor. LiteLLM is used across the AI industry, and Mercor says the attack hit “a significant number of companies globally.”

If you’re comparing options, our micro1 review covers Mercor’s closest rival.

Common mistakes after the Mercor breach

• Assuming you weren’t affected because the notice went to spam
• Paying for a credit monitoring service when a free credit freeze protects you better
• Clicking a “Mercor settlement” link in an email before checking it against the court docket
• Signing up with several law firms, when class members are included automatically if a case settles
• Keeping the same password on Mercor and other sites
• For companies, sending a buyer more records than the project needs

Frequently asked questions

Was Mercor hacked?

Yes. Attackers got into some of Mercor’s systems between March 24 and 30, 2026, through malware hidden in two versions of LiteLLM, an open-source AI tool Mercor used. They downloaded data that included contractors’ personal information.

What information was exposed in the Mercor breach?

Mercor’s filing with the Texas Attorney General lists names, addresses, Social Security numbers, driver’s license numbers, government ID numbers such as passports, and dates of birth. What was taken varies by person, and each notice letter says which items applied.

How many people were affected by the Mercor data breach?

Mercor hasn’t published a total. Its Texas filing counts 2,025 Texans, and ClaimDepot’s tally of state filings puts the total at 21,677 people. Mercor says it has nearly five million experts, and only a very limited subset had sensitive data affected.

How do I know if my data was in the Mercor breach?

Mercor emailed affected contractors on June 25 and 26, 2026 with a notice of data breach. If you didn’t get one, call Mercor’s breach call center at 1-844-507-8047, 8 a.m. to 8 p.m. Eastern, Monday to Friday.

Can I still get free credit monitoring from Mercor?

Not through the original code. Mercor offered 24 months of TransUnion credit monitoring, but the enrollment deadline was October 1, 2026. A credit freeze at Equifax, Experian and TransUnion is free and gives stronger protection.

Is there a Mercor data breach settlement?

Not as of October 29, 2026. The California class actions were combined into Deboni v. Mercor.io Corporation in May 2026, and the court paused the case on July 21, 2026 while the two sides try mediation.

Is Mercor safe to use after the breach?

Mercor still pays contractors and companies, and says it has added tighter cloud controls, credential rotation, penetration testing and 24/7 monitoring. The breach is a reason to share only what a project needs, not a reason to assume Mercor is a scam.