Mercor Data Breach Shakes $10B AI Startup: Meta Halts Contracts as Lawsuits Pile Up

In a major setback, Mercor, the $10 billion-valued AI data training startup, admitted to a significant data breach on March 31, 2026.

The breach was linked to malware in the open-source LiteLLM project, which stole credentials and allowed hackers to access 4TB of sensitive information.

The Scope of the Breach

Exposed data reportedly includes candidate profiles, personally identifiable information, employer details, source code, and API keys.

Mercor is investigating but has not confirmed the stolen data's authenticity.

Mercor's Explosive Growth

Six months ago, Mercor raised $350 million in Series C funding at a $10 billion valuation.

Before the incident, the company was on track to exceed $1 billion in annualized revenue.

Industry-Wide Fallout

Meta has paused its contracts with Mercor indefinitely.

Five contractors filed lawsuits over exposed personal data.

One suit also names LiteLLM and Delve amid security certification controversies.

OpenAI is probing its exposure without suspending ties yet.

Mercor vows to resolve the issue quickly and notify affected parties directly.

The breach threatens Mercor's future growth and could spur stricter AI data regulations.