Mercor data breach: what happened and what to do (2026)

What happened

In March 2026 an attacker published compromised versions of LiteLLM, a widely used open-source tool for connecting software to AI models. The tainted versions were built to steal credentials from any system that installed them. Mercor says it was affected during that window, contained the activity, and investigated with Google's Mandiant, Latacora and law enforcement.

Mercor confirmed the incident publicly on March 31, 2026, describing itself as one of thousands of companies affected. The same day, the extortion group Lapsus$ claimed it had taken Mercor data. TechCrunch reviewed a sample the group shared, which referenced Slack data, what appeared to be ticketing data, and two videos that purportedly showed contractors talking to Mercor's AI systems.

What data was affected

Mercor's own account is narrow: of nearly five million experts, a very limited subset had sensitive information affected, and no employee data was affected. It has not published a number or a full list of data types. Each notification email says what kind of information was involved for that person.

The attackers' claims were much larger. WIRED reported that they claimed a database of more than 200 GB, nearly 1 TB of source code and 3 TB of video and other files. Those are the attackers' claims, not confirmed findings. Lawsuits filed by contractors allege that personal information they gave Mercor, such as tax forms, was exposed.

How to tell if you were affected

• Search your inbox and spam folder for a message from mercor@notifications.cyberscout.com, sent on June 25 or 26, 2026. That is the only notification address Mercor has named.
• The email describes the type of information affected and includes an offer of TransUnion identity protection services.
• If you worked with Mercor and have no email, Mercor's statement implies your sensitive information was not among the affected set. Ask Mercor support if you want that in writing.
• Treat any other breach email, text or call claiming to be Mercor with suspicion. Breach news is routinely followed by phishing that imitates the real notice.

What to do if you were affected

• Take up the identity protection offer in your notification email, using the link in that email only.
• If you are in the US, place a free credit freeze with Equifax, Experian and TransUnion. It stops new credit being opened in your name and does not affect your score.
• Change your Mercor password, and any other account that shared it. Turn on two-step sign-in for your email and payout accounts (Stripe or Wise).
• Watch your bank, Stripe and Wise accounts for payouts or changes you don't recognise.
• If a tax ID such as a Social Security number was involved, consider an identity-protection PIN from your tax authority where one exists (the IRS offers one in the US).
• Never pay anyone who contacts you about the breach, and don't share verification codes. Mercor and real platforms don't charge contractors.

The lawsuits

Business Insider reported that contractors filed five lawsuits against Mercor within a week of the disclosure, accusing it of violating data privacy and consumer protection laws and seeking unspecified damages. One, reported by Westlaw Today, is a proposed class action filed on April 1, 2026 in the US District Court for the Northern District of California.

You'll also find law firms and claims companies advertising for affected contractors. Whether to join a case is a personal decision; read the terms and fee arrangement first. This page is not legal advice.

What it meant for work on Mercor

WIRED reported on April 3, 2026 that Meta paused all its work with Mercor indefinitely while it investigated, and that contractors on Meta projects could not log hours in the meantime. OpenAI said it was investigating but had not stopped its projects.

In its June 2026 update Mercor said all frontier labs had increased their work with it over the previous few months. We can't verify that directly. What we can show is the number of public Mercor roles open today, at the top of this page.

What Mercor says it changed

• Audited all third-party software dependencies.
• Rotates credentials and access keys regularly across its cloud platforms, GitHub and SaaS systems.
• Tightened cloud security policies and network controls.
• Ongoing penetration testing by independent security researchers.
• Round-the-clock managed detection and response.

Should you still apply to Mercor?

That depends on how you weigh it. Mercor still requires identity verification and, for many roles, a recorded AI interview, so applying means handing over sensitive information. The breach came through a third-party tool that affected many companies, and Mercor has described what it changed. A sensible middle path is to share only what a specific role requires, when it requires it, and to use a unique password and two-step sign-in.