HackingTechnologyInformationStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowResolved

Mercor.io Corporation

bd_4b2b7aca4d4faac0 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 25, 2026

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

65%

Full breach record for Mercor.io Corporation →

Mercor.io Corporation disclosed a data breach resulting from malware inserted into LiteLLM's code scanning tool, a third-party software supply chain compromise. The unauthorized actor accessed Mercor's systems between March 24 and March 30, 2026, and exfiltrated data. Mercor detected and blocked the activity, engaged third-party experts, and is offering 24 months of credit monitoring to affected individuals. The investigation is complete.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 24, 2026

Begins

Jun 25, 2026

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Nebraska State AGbd_87c464c27c740e3e2026-06-25Verified
Vermont State AGbd_a5f5a6a4aeaf7dc72026-06-25Verified
Indiana State AGbd_b03231cefec241c92026-06-25Verified
New Hampshire State AGbd_ef03878ae68572282026-06-25Verified

Show 3 more filings ↓up to 24d gap

Massachusetts State AGbd_fc1f4ab8435c65fa2026-06-25Verified
Texas State AGbd_fbf3b700b3f6f2952026-06-26 · +1dVerified
Illinois State AGbd_1b273a2948a630b82026-06-01 · +24dVerified

Name: Mercor.io Corporation
norm: mercorio

Name: Mercor.io Corporation
norm: mercorio
Industry: Technologyllm

Discovered: —
Breach occurred: Mar 24, 2026 – Mar 30, 2026
Materiality determined: —
Notification sent: Jun 25, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via LiteLLM
Initial access: supply_chain

During the incident: Detected and blocked the activity
Working with third-party security experts to investigate
Offering 24-months of complimentary credit monitoring and identity restoration services through TransUnion
Changes made: Enhancing security and monitoring controls
Strengthening IT security and data privacy controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJun 1 · first

Nebraska State AG+24d

Vermont State AG+24d

Indiana State AG+24d

New Hampshire State AG+24d

Massachusetts State AG+24d

California State AG+24d · this page

Texas State AG+25d

Pattern: first filing Jun 1 (IL), last Jun 26 (TX) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-625431
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 25, 2026
Raw hash: e2193f4ee4aa289ef6627e503cf573b6534b0efcbacf49c467ae3ab34d8337e4

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMercor.io Corporation

Victim entityMercor.io Corporation

IncidentThird-Party / Supply Chain

Stated responseDetected and blocked the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov