MalwareTechnologyInformationRansomwareSupply Chain (3P Vendor)Data ExfiltratedData EncryptedPIIIdentity (basic)LowContained

Mercor.io Corporation

bd_87c464c27c740e3e · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 24, 2026

Filed

Jun 25, 2026

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

65%

Full breach record for Mercor.io Corporation →

Mercor io Corporation notified Nebraska AG of a data breach involving unauthorized access to its systems via a supply-chain compromise (LiteLLM code scanning tool malware). The incident occurred March 24-30, 2026. Mercor detected and blocked the activity, engaged third-party experts, and is offering 24 months of credit monitoring. Personal information of experts was downloaded.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 24, 2026

Begins

Mar 24, 2026

Discovered

Jun 25, 2026

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_4b2b7aca4d4faac02026-06-25Candidate
Vermont State AGbd_a5f5a6a4aeaf7dc72026-06-25Verified
Indiana State AGbd_b03231cefec241c92026-06-25Verified
New Hampshire State AGbd_ef03878ae68572282026-06-25Verified

Show 3 more filings ↓up to 24d gap

Massachusetts State AGbd_fc1f4ab8435c65fa2026-06-25Verified
Texas State AGbd_fbf3b700b3f6f2952026-06-26 · +1dVerified
Illinois State AGbd_1b273a2948a630b82026-06-01 · +24dVerified

Name: Mercor.io Corporation
norm: mercorio

Name: Mercor.io Corporation
norm: mercorio
Industry: Technologyllm

Discovered: Mar 24, 2026
Breach occurred: Mar 24, 2026 – Mar 30, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 25, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Detected and blocked the activity
Working with third-party security experts to investigate what happened
Strengthen our security
Offering 24-months of complimentary credit monitoring and identity restoration services through our preferred third-party vendor, TransUnion
Enhancing our security and monitoring controls
Changes made: Enhancing our security and monitoring controls
Strengthen our IT security and data privacy controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJun 1 · first

California State AG+24d

Vermont State AG+24d

Indiana State AG+24d

New Hampshire State AG+24d

Massachusetts State AG+24d

Nebraska State AG+24d · this page

Texas State AG+25d

Pattern: first filing Jun 1 (IL), last Jun 26 (TX) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/ac1c0683-f1d4-4449-bde7-b8fd5317184c.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 25, 2026
Raw hash: a4f852870a6d209beb900486673db0b7852a7f66cdef2a8abe0fae122a73f0d6

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMercor.io Corporation

Victim entityMercor.io Corporation

Incidentdiscovered Mar 24, 2026

Stated responseDetected and blocked the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov