AI recruiting startup Mercor has confirmed a security incident linked to a supply chain attack involving the open source project LiteLLM. The company stated it was one of thousands affected by a compromise linked to hacking group TeamPCP. Extortion group Lapsus$ also claimed responsibility, sharing a sample of alleged Mercor data including Slack references and ticketing information. Founded in 2023, Mercor works with companies like OpenAI and Anthropic, facilitating over $2 million in daily payouts. A company spokesperson said they moved promptly to contain the incident and are conducting a thorough investigation with third-party experts. The LiteLLM compromise, discovered last week, involved malicious code in a widely downloaded library, prompting the project to change its compliance providers. The full scope of the incident remains under investigation.
