In March 2026, Mercor.io, an AI recruiting platform, experienced a data breach. The incident was a supply-chain attack involving the third-party open-source LiteLLM project, which reportedly affected Mercor and thousands of other companies. Mercor confirmed the incident and began mailing notification letters to affected individuals on June 25, 2026, also reporting the incident to the California Attorney General.
The breach exposed a range of data, including candidate profiles, personally identifiable information, employer data, source code, API keys, secrets, Slack data, internal ticketing data, interview recordings, facial biometrics, background-check files, tax and banking data, and identity documents like passport scans. While Mercor stated that only a very limited subset of its nearly five million experts was affected, outside reporting and litigation papers allege more than 40,000 contractors and individuals were impacted.
Additional details about the full scope of the breach and the number of individuals affected may emerge over time. Consumer notifications were issued in June 2026.