Mercor.io Corporation
bd_ef03878ae6857228 · schema v1 · pii pii-v1
Full breach record for Mercor.io Corporation →Mercor.io Corporation experienced a supply chain attack via LiteLLM's code scanning tool, allowing unauthorized access to systems between March 24-30, 2026. Malware installed by the actor enabled data exfiltration. Approximately 68 New Hampshire residents had government IDs (passport/driver's license numbers) exposed. The company engaged forensics, notified law enforcement, and is offering credit monitoring.
J jump to incidentP pin to compareR raw source
Incident timeline
Mar 24, 2026
Begins
Mar 24, 2026
Discovered
Jun 25, 2026
Filed
vs. sector median
6 wks faster
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- California State AGbd_4b2b7aca4d4faac02026-06-25Candidate
- Nebraska State AGbd_87c464c27c740e3e2026-06-25Verified
- Vermont State AGbd_a5f5a6a4aeaf7dc72026-06-25Verified
- Indiana State AGbd_b03231cefec241c92026-06-25Verified
Show 3 more filings ↓Show fewer ↑up to 24d gap
- Massachusetts State AGbd_fc1f4ab8435c65fa2026-06-25Verified
- Texas State AGbd_fbf3b700b3f6f2952026-06-26 · +1dVerified
- Illinois State AGbd_1b273a2948a630b82026-06-01 · +24dVerified
Filing propagation · 8 filings · 8 states
View merged incident ↗Pattern: first filing Jun 1 (IL), last Jun 26 (TX) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.