HackingTechnologyInformationBackdoor / C2Supply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPIIMediumContained

Mercor.io Corporation

bd_fc1f4ab8435c65fa · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 25, 2026

To disclose

—

Affected

778state residents only

Linked

8 filings

Confidence

65%

Full breach record for Mercor.io Corporation →

Mercor.io Corporation experienced a data breach due to malware inserted into a third-party code scanning tool provided by LiteLLM. The unauthorized actor accessed Mercor's systems between March 24-30, 2026, and exfiltrated data. Mercor detected and blocked the activity, engaged third-party security experts, and is offering 24 months of credit monitoring to affected individuals. The incident is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 24, 2026

Begins

Jun 25, 2026

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_4b2b7aca4d4faac02026-06-25Candidate
Nebraska State AGbd_87c464c27c740e3e2026-06-25Verified
Vermont State AGbd_a5f5a6a4aeaf7dc72026-06-25Verified
Indiana State AGbd_b03231cefec241c92026-06-25Verified

Show 3 more filings ↓up to 24d gap

New Hampshire State AGbd_ef03878ae68572282026-06-25Verified
Texas State AGbd_fbf3b700b3f6f2952026-06-26 · +1dVerified
Illinois State AGbd_1b273a2948a630b82026-06-01 · +24dVerified

Name: Mercor.io Corporation
norm: mercorio

Name: Mercor.io Corporation
norm: mercorio
Industry: Technologyllm

Discovered: —
Breach occurred: Mar 24, 2026 – Mar 30, 2026
Materiality determined: —
Notification sent: Jun 25, 2026
Affected individuals: 778state-resident count only
Data types: Identity (basic)Government IDPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via LiteLLM
Initial access: supply_chain

During the incident: Detected and blocked the activity
Working with third-party security experts to investigate
Offering 24-months of complimentary credit monitoring and identity restoration services through TransUnion
Changes made: Enhancing our security and monitoring controls
Strengthen our IT security and data privacy controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJun 1 · first

California State AG+24d

Nebraska State AG+24d

Vermont State AG+24d

Indiana State AG+24d

New Hampshire State AG+24d

Massachusetts State AG+24d · this page

Texas State AG+25d

Pattern: first filing Jun 1 (IL), last Jun 26 (TX) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1030-mercorio-corporation/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 25, 2026
Raw hash: 24cdbc119ffa2bb6379d3bef5d364e57725844aae8d0b3233f4cffa36b556191

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMercor.io Corporation

Victim entityMercor.io Corporation

IncidentThird-Party / Supply Chain

Stated responseDetected and blocked the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov