Mercor's 4TB Breach Exposed How OpenAI, Meta, and Anthropic Actually Train Models
Mercor, the AI-training-data startup valued at $10 billion, confirmed on March 31, 2026 that attackers had pulled roughly 4TB of data out of its systems by chaining together vulnerabilities in LiteLLM, the open-source gateway that sits between applications and the various LLM providers they call. The entry point was infrastructure, not Mercor's own application code.
What was actually in the 4TB
The exposure covers more than 40,000 contractors who did labeling and evaluation work for Mercor: their passports, Social Security numbers, financial account details, and biometric video interviews recorded as part of onboarding. Alongside the personal data, the stolen set reportedly included proprietary detail on how OpenAI, Meta, and Anthropic structure their training data pipelines, since Mercor's business is building and managing that pipeline work on their behalf.
Halborn's account of the incident, published under the title "Explained: The Mercor Hack," traces the breach to a chain of LiteLLM vulnerabilities rather than a single exploit, meaning attackers moved through more than one weakness to get from initial access to the full data pull. Tech Insider's reporting adds that the LAPSUS$ group reportedly claimed responsibility and put the stolen data up for auction, though that attribution should be read as reported rather than independently confirmed.
Why a training-data vendor is a high-value target
Mercor doesn't sell a consumer product. It sells the labor pipeline that feeds frontier model training, which means a breach there doesn't just expose one company's customer list, it exposes the working relationships and process detail of the model labs sitting one layer upstream. That's a different kind of damage than a typical SaaS breach, because the sensitive asset isn't only personal data, it's competitive and technical detail about how the biggest AI labs actually operate.
It also means the contractor population caught in the exposure, gig workers who submitted passports and biometric video to get labeling work, had no direct relationship with the model labs whose pipelines their data supported. They signed up with Mercor, not with OpenAI, Meta, or Anthropic, and had no way to know their most sensitive documents were sitting behind LiteLLM infrastructure.
The infrastructure lesson
LiteLLM sits in an unusually large number of AI stacks as the default way to route requests across providers, which makes any vulnerability in it a multiplier rather than a single-company problem. A breach at the gateway layer takes down whatever is behind it, and in Mercor's case that included personal identity documents for tens of thousands of people who never chose to trust LiteLLM with anything.
If your own stack routes through LiteLLM or a similar gateway, this is a reason to check patch status directly rather than assume the vendor relationship covers it. The gateway is infrastructure you depend on, not a black box you can treat as someone else's problem.