Market news
The Mercor data breach, explained for business owners
In March 2026, Mercor, an AI data company valued at $10B, was hit by a cyberattack through LiteLLM, a free open-source software tool. Mercor says only a very limited subset of its nearly five million experts had sensitive data affected. A hacking group claimed it took far more. Several proposed class actions followed.1,2,3,4,5
What happened, in order
Mercor did not get hacked in the usual way, through a guessed password or a fake email. The attackers poisoned a tool. LiteLLM is open-source software, meaning free code that anyone can use, and many companies build it into their systems. Someone published bad versions of it that stole login details from any system that installed them. Mercor was one of the companies caught.2
- Late March 2026: Mercor confirms a cyberattack tied to the compromise of LiteLLM.2
- 1 April 2026: several proposed class actions are filed against Mercor in federal court in Northern California.5
- 2 April 2026: Fortune reports that the extortion group Lapsus$ claims up to four terabytes, including source code and database records, and has posted samples. Mercor does not answer questions about those claims.4
- 25 and 26 June 2026: Mercor notifies the affected experts and offers them TransUnion identity protection.3
Who was affected
Mostly the experts. Mercor hires doctors, lawyers, engineers and other specialists to do AI training work, and says it has nearly five million of them on its books. It says a very limited subset had sensitive information affected, and that it has seen no sign of the data being used for fraud.3
Mercor says no employee data was affected, and that the impact on customer information was very limited, because many customers work on their own platforms. Its customers include Anthropic, OpenAI and Meta.3,6
What is still unclear is the size. Mercor has not published a count of affected people, and no reliable outside count exists. The hackers' samples reportedly included Slack messages, ticket records and recorded AI interviews with contractors. Those are the group's claims, and Mercor has not confirmed them.2,4
Why this matters if you are thinking of selling data
Mercor also buys company data. Its data program asks a business to link accounts such as Slack, Gmail and Salesforce, and says the copying and scrubbing of personal details are fully automated. Mercor's breach notice does not say whether that program was touched.7,3
The lesson is not only about Mercor. Any company that holds a copy of your records becomes a place those records can leak from. Mercor says it holds an outside security audit, SOC 2 Type II, and the attack still got in through a tool it depended on. Our reading: an audit badge tells you a company has security habits, not that it cannot be breached.8,2
Since the attack, Mercor says it audits all the outside code it depends on, rotates passwords and keys, has tightened its cloud and network controls, pays outside testers to try to break in, and watches its systems around the clock. It says it worked with Google's Mandiant, Latacora and law enforcement.9
Pros and cons
Pros
Cons
- Experts were notified about three months after the attack: it was confirmed in late March and notices went out on 25 June.2,3
- Mercor has not published how many people were affected.2
- A hacking group claims up to four terabytes, and Mercor has not answered those claims.4
- Several proposed class actions are open.5
What it means for a business like yours
If you were weighing a data deal with Mercor, the breach is a reason to ask harder questions, not a verdict. The same questions apply to every buyer, because every buyer that keeps your records is a target.2
Ask how long they keep your copy and how it is deleted. Buyers differ a lot. micro1's written terms say it deletes data within 120 days of final delivery. Nyne's ads say raw files are deleted within 30 days. Get the number in the contract, not just in an ad.10,11
Ask whether they need to log into your systems at all. One law firm that advises sellers says a buyer should get no direct access to company systems. Exporting a cleaned copy yourself, or through a firm you hire, keeps your own accounts closed.12
Should your business get in now?
Businesses are already licensing their records: micro1 has committed $1B over 12 months to buying company data, and at least 18 firms started advertising for it between September and mid-October 2026.13,14 Our view, not a promise: the money will not be around forever, because prices tend to come down as more businesses sell.13,15 Take the quiz to see which firms fit your business.
Plus a free Seller's Guide when you finish.
Plus a free Seller's Guide when you finish.FAQ
Questions, answered with sources
In March 2026 attackers published poisoned versions of LiteLLM, an open-source tool, that stole login details from systems using it. Mercor was one of the companies hit.2
The extortion group Lapsus$ claimed it and posted samples, Fortune reported. Mercor did not answer questions about those claims.4
Mercor says the impact on customer information was very limited, because many customers work on their own platforms, and that no employee data was affected.3
Several proposed class actions over the Mercor breach were filed on 1 April 2026 in the Northern District of California.5
Mercor says it now audits all outside code it depends on, rotates credentials, has tightened cloud controls, runs outside penetration tests and monitors around the clock.9
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- How and how fast will you tell us if data we licensed to you is exposed?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?