Mercor.io Corporation has notified individuals of a cybersecurity incident involving unauthorized access to its systems through a compromised third-party code scanning tool, LiteLLM. While there is no evidence of misuse of the affected information, the company is offering resources to help impacted individuals protect their personal information.
Mercor.io Corporation’s Data Breach Investigation
In late March 2026, Mercor.io discovered that an unauthorized actor had exploited a supply chain vulnerability in LiteLLM, a widely used code scanning tool. This malware enabled the actor to access Mercor.io’s systems between March 24 and March 30, 2026. Upon detection, the company immediately blocked the unauthorized activity and engaged a third-party forensic firm to investigate the scope of the incident and the data potentially impacted.
The investigation confirmed that the malware allowed access to certain files containing personal information, including passport numbers, driver’s license numbers, and other government-issued identification information of approximately 68 New Hampshire residents. Mercor.io promptly notified law enforcement and began notifying affected individuals via email starting on June 25, 2026.
To prevent future incidents, Mercor.io strengthened security and monitoring controls across its systems, including enterprise-wide safeguards and enhanced IT security protocols.
When Did This Breach Occur?
Unauthorized access occurred between March 24 and March 30, 2026. Discovery of the incident and engagement of forensic experts occurred immediately upon identifying the activity. Notifications to affected individuals began on June 25, 2026.
What Information Was Breached?
The data potentially accessed by the unauthorized actor includes:
- Passport numbers
- Driver’s license numbers
- Other government-issued identification information
This sensitive data can increase the risk of identity theft or fraudulent activity even if no misuse has yet been observed.
What You Can Do
Affected individuals should take proactive steps to safeguard their information:
- Enroll in Complimentary Credit Monitoring: Mercor.io is offering 24 months of credit monitoring and identity restoration services through TransUnion and Cyberscout at https://bfs.cyberscout.com/activate. Enrollment requires a unique code provided in the notice and must be completed by October 1, 2026.
- Monitor Accounts: Regularly review bank statements, credit reports, and other financial accounts for unauthorized activity.
- Obtain Free Credit Reports: Individuals are entitled to one free credit report per year from Equifax, Experian, and TransUnion at www.annualcreditreport.com or by phone at 1-877-322-8228.
- Place Fraud Alerts or Security Freezes: Contact credit reporting agencies to place an initial 1-year or extended 7-year fraud alert or a security freeze to prevent unauthorized access.
- Report Suspicious Activity: File a police report, and notify your state Attorney General or the Federal Trade Commission at www.identitytheft.gov if you suspect identity theft.
State-specific guidance is provided for residents of California, District of Columbia, Iowa, Kentucky, Maryland, Massachusetts, North Carolina, New Mexico, New York, Oregon, Rhode Island, and other applicable states.
File a Data Breach Lawsuit Against Mercor.io Corporation
Companies that handle sensitive personal and government-issued identification information have a duty to implement reasonable safeguards. When unauthorized access occurs, affected individuals may have legal options to recover damages for time spent mitigating risk, privacy violations, and other costs.
If you received a notice from Mercor.io or believe your personal information was exposed, you may explore legal remedies through a class action lawsuit. Participation can help hold the company accountable and promote stronger protections for sensitive data.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
