Mercor confirmed a cyberattack tied to the compromise of the open-source LiteLLM project, and several class actions followed.5,6
Key facts
Mercor in its own words and others'
| Fact | Value and source |
|---|---|
| Data it buys | Slack, Teams, Gmail, Outlook, Confluence, Salesforce, GitHub, Drive, Notion and 100+ other tools |
| Industries Mercor Data names | Legal; healthcare; finance and insurance; professional services; manufacturing; retail and e-commerce; real estate; logistics and supply chain |
| Offer range | Not published |
| Seller fees | No fees |
| Time to payment | Wire 2-4 weeks after signing |
| Security attestation | SOC 2 Type II |
What it buys
What Mercor takes, and from whom
Mercor lists Slack, Teams, Gmail, Outlook, Confluence, Salesforce, GitHub, Drive, Notion and 100+ other tools. It names legal, healthcare, finance and insurance, professional services, manufacturing, retail and e-commerce, real estate, and logistics and supply chain.7,8
It watches acquisitions: it approached Warmly about its archives after HubSpot acquired the company. It bid $7.5M for Spirit Airlines' archive and is the backup buyer. If your company is being bought or wound down, expect Mercor to be one of the first calls, and compare its terms with at least one other buyer before you answer.9,10
Warning
The breach, and what to ask about it
Mercor confirmed a cyberattack tied to the compromise of the open-source LiteLLM project. It later described the affected data as a very limited subset; no reliable count of affected people has been published. Several class actions were filed on 2026-04-01 in the Northern District of California.5,6
Ask Mercor what changed in how seller data is stored and accessed since the incident, and who can see it before personal data is removed. Ask for its SOC 2 Type II report and the period it covers, and whether seller data sits in the systems that were affected.2
Scale
How big Mercor is
Against the others
How Mercor compares for a seller
Mercor publishes no price, where micro1 and Polyshares state $100K-$2M+ and Nyne says $100K or more. It publishes the fastest payment, a wire 2-4 weeks after signing, where Polyshares pays Net 30-60 after an offer in 1-2 weeks and micro1 publishes no timeline. On personal data, Polyshares says a third-party partner scrubs it before licensing, and micro1 says PII is removed when relevant; Mercor's page states SOC 2 Type II.4,13,14,15,3,16,17,18,2
Process
How it works with each buyer
In each buyer's own published words. Where a buyer publishes nothing, we say so rather than guess.
Check first
How to check Mercor, or any buyer
The same checks for every company we profile. We state facts; you decide.
- 1.Find the company behind the ad: a legal name, a registered address and named people.
- 2.Ask for a written offer and a sample agreement before you send any data.
- 3.Ask who removes personal data, by what method, and approve it before anything is exported.
- 4.Ask which AI labs will receive the data, and whether you will be told.
- 5.Ask how they are paid: by you, by the buyer, or from a share of your deal.
- 6.Get terms from at least one other buyer before you answer.
FAQ
Questions, answered with sources
Mercor says it holds SOC 2 Type II. Ask for the report and its date, and whether it covers the systems that hold seller data.2
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
Before you sign
Legal questions go to the licensing company
We do not answer legal questions. Ask the licensing company before you sign: their team reviews these with you.
Questions for this kind of business
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
- Do customer, vendor or platform contracts, NDAs or API terms restrict this?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?