Is Mercor legit for selling company data? What an owner can check

Mercor's SEC notice from February 18, 2026 lists Brendan Foody and Adarsh Hiremath as executive officers and directors, at 181 Fremont Street in San Francisco. Dealroom, citing The Information, reported above $2B gross run rate as of June 2026, and Mercor gives no separate figure for its data program.^1,8,3

Its one public data deal is a bid, not a purchase: Mercor offered $7.5M for Spirit Airlines' archive, Google won with $10M, and Mercor is the backup buyer.⁹

Mercor confirmed a cyberattack tied to the compromise of the open-source LiteLLM project, and several proposed class actions from contractors who used the platform were filed on April 1, 2026, with allegations that remain unproven. Mercor says the attack hit many companies, that a very limited subset of its nearly five million experts had sensitive information affected with no evidence of fraudulent use, and that the impact on customer information was very limited. The extortion group Lapsus$ claimed up to four terabytes; those are the group's claims, and Mercor did not answer Fortune's questions about them.^{4,5,6,10,11,12}

Owners also ask because the contact can come out of nowhere. AI Weekly, summarising The Information, reports that Mercor approached Warmly about its archives after HubSpot acquired that company, so a message after a sale is consistent with how it has worked, and it still needs checking.¹³

Search EDGAR, the SEC's free filing database, for Mercor.io Corp. A second filer has a similar name, Mercor.io a Series of What If Ventures Master LLC in Claymont, Delaware, and that is a different entity, so look for the San Francisco address.¹

Ignore the domain date. mercor.com was registered in 2002, about 20 years before the company was incorporated, so it tells you nothing here. What counts is that the program lives at mercor.com/data and that anyone writing for Mercor uses a mercor.com address. Mercor pays people who refer companies, so the person contacting you may not work for it, and you can ask whether they earn a referral fee.^14,15,16

Read Mercor's own update on the incident on its blog. It lists what it says changed, including outside penetration testing and round-the-clock monitoring, which gives you specific points to raise.^10,17

Look at Trustpilot, which shows 2.5 out of 5 from 5 reviews. That page covers all of Mercor, not only its data deals, so it says little about how sellers are treated.⁷

Reread the payment line. Mercor pays by wire "upon delivery of the anonymized dataset to the buyer", typically within 2-4 weeks of the signed agreement, so the money depends on delivery as well as signing.¹⁸

Ask Mercor for its price in writing, since none is published, and which lab would receive your data, since none is named. Ask for its SOC 2 Type II report and the period it covers, and whether seller data sits in the systems affected by the attack. Ask what happens to payment if delivery to the buyer is delayed.^19,3,20,18

Mercor is not one of the firms we introduce, so talk to it directly at mercor.com if you want its terms. Our match shows which buyers we do work with take a company like yours, so you have another buyer's terms to set against Mercor's.