The number itself was almost abstract. Four terabytes—enough storage to hold roughly 180,000 hours of standard HD video, give or take. But the hackers who claimed they'd extracted that much data from Mercor in late March weren't trafficking in abstractions. According to their inventory, most of those terabytes contained something far more concrete: voice recordings and identity-verification footage from tens of thousands of contract workers who had passed through the AI talent platform's vetting process.
When Mercor confirmed the breach on April 1, the company's statement ruled out the usual suspects. No missed patch. No misconfigured S3 bucket. Instead, the intrusion traced back to three hours of compromised code in a Python package called LiteLLM—a tool many AI companies rely on to route requests across multiple language models. Three hours was all it took.
The consequences arrived with speed that suggested the industry had been holding its breath. Meta paused all work with Mercor by early April, WIRED reported. Class-action lawsuits materialized within weeks—multiple suits filed in California and Texas, with reports ranging from four to seven separate actions—invoking Illinois' Artificial Intelligence Video Interview Act and biometric privacy statutes. Meanwhile, a hacker group known as Lapsus$ published what they described as detailed inventories: roughly 3 TB of video interview and verification media, 939 GB of source code, and over 200 GB of database records, according to Cybernews reporting from April 1.
For founders building in the AI space, the Mercor incident offers more than cautionary theater. It stress-tests assumptions that have quietly underpinned the industry's breakneck growth—that training data pipelines are secure by default, that third-party contractor platforms handle biometrics with appropriate care, that supply-chain risks belong on someone else's checklist.
The breach suggests those assumptions may need revisiting.
A Market Built for Speed, Not Scrutiny
The AI training data ecosystem has scaled faster than the security architecture meant to protect it. Gartner forecast worldwide AI spending would reach $2.52 trillion in the year the breach occurred, announced that January. McKinsey's State of AI report from late the previous year found that 23% of enterprises were already scaling agentic AI, while another 39% were experimenting.
Those models require fuel. Labeled data. Human feedback loops. Voice samples for conversational interfaces. Video for multimodal understanding. The demand created a sprawling network of platforms and contractors, some operating at eye-watering valuations.
Scale AI, valued between $14 billion and $29 billion across recent years, claimed estimated revenue of $870 million, according to public sources. TELUS International positioned itself as a leader in data labeling software, per a December 2023 IDC MarketScape report. Surge AI marketed reinforcement learning from human feedback (RLHF) capabilities, citing Anthropic as a case study. Grand View Research valued the U.S. data collection and labeling market at $677.6 million in 2023, projecting a 24.5% compound annual growth rate to 2030, with outsourced work accounting for 84.6% of the market.
Mercor entered this market in 2023. Founders Brendan Foody, Adarsh Hiremath, and Surya Midha built a straightforward business model: vet technical contractors, match them with AI companies that needed human input for model training, evaluation, and alignment. By late the following year, the company had raised $350 million in a Series C round that valued it at $10 billion. The Information reported the company had been rumored to be running at a greater-than-$1 billion annual recurring revenue rate, a figure TechCrunch cited in its coverage. Customers reportedly included OpenAI and Anthropic.
What wasn't straightforward was the volume of sensitive data that model implied. Video interviews for vetting. Voice samples for verification. Identity documents. All of it potentially usable for deepfake generation if it fell into the wrong hands—a concern Consumer Reports had flagged when it found six leading voice-cloning products lacked robust consent verification.
Three Dynamics, One Breach
The Mercor compromise didn't emerge from a single failure. Three dynamics converged to make it both possible and consequential.
The supply chain. On March 24, a hacker group called TeamPCP managed to backdoor LiteLLM versions 1.82.7 and 1.82.8 on the Python Package Index (PyPI) for approximately three hours, according to Kaspersky's analysis and other security research published in late March and April. The compromise followed a pattern. TeamPCP had previously compromised Aqua Security's Trivy scanner, which enabled them to steal tokens from CI/CD pipelines, then use those credentials to push malicious code into widely-used packages. Cloud Security Alliance research documented the "cascading" pattern: Trivy to LiteLLM to lateral movement into Kubernetes environments of downstream users.
LiteLLM itself is a kind of AI gateway—a broker layer that lets developers call OpenAI, Anthropic, Cohere, or other model APIs through a single interface. It's exactly the kind of tool that proliferates in fast-moving AI engineering organizations, where convenience often wins arguments with security. When it was compromised, even briefly, the malware harvested credentials that could unlock multiple environments. Mercor confirmed the breach was linked to the LiteLLM supply-chain attack in its April 1 statement.
The regulatory gap. As of early April, there was no federal U.S. law specifically governing AI training data or biometric information collected in contractor vetting flows. Illinois had its Biometric Information Privacy Act (BIPA) and the Artificial Intelligence Video Interview Act (AIVIA), effective since 2020, which required notice, consent, and deletion-on-request for AI-analyzed video interviews. Colorado had amended its privacy act to cover biometrics, with compliance windows spanning the following years. But enforcement remained fragmented.
The European Union's AI Act had a general application date still months away when Mercor's breach occurred. The U.S. had Executive Order 14110 from October 2023 and OMB guidance (M-24-10, published March 2024) on AI governance for federal agencies, but nothing binding for private AI platforms at scale.
Into that gap fell considerable volumes of voice data. Gartner reported that 91% of customer service leaders were under pressure to implement AI, driving conversational and agentic deployments into front-line service roles—and creating vast new corpora of voice recordings under vendor control. WIRED had covered controversies years earlier when Apple, Amazon, and Google faced scrutiny for contractors listening to user audio without clear consent; Apple apologized and changed defaults in August 2019. The underlying tension—who controls voice biometrics, and what happens when they're breached—remained largely unresolved.
The sheer volume. If the attackers' claims are even directionally accurate, Mercor had accumulated terabytes of verification media. That's not unusual for a platform vetting tens of thousands of contractors. Secondary sources and legal filings referenced "40,000+" affected workers, though Mercor never released a definitive count and the figure remains unverified. TechCrunch noted in its April 9 report that there had been "no formal acknowledgments of how much data was scooped up," and the 4 TB figure remained an attacker claim rather than a confirmed forensic finding.
But scale alone shifts risk calculus. A 2023 incident at Microsoft—a misconfigured SAS token that exposed 38 TB of internal AI research data, reported by Wiz on September 18, 2023—illustrated how cloud storage governance lapses around training corpora could lead to massive exposures. The World Economic Forum's Global Cybersecurity Outlook for the following year found that 87% of organizations identified AI-related vulnerabilities as the fastest-growing cyber risk, and the share actively assessing the security of AI tools had risen from 37% to 64% over the course of a year.
April's Rough Month
Mercor's breach didn't happen in isolation. The same month proved unusually difficult for third-party AI risk.
Bloomberg, The Guardian, and WIRED all reported between April 21 and April 25 that unauthorized users had accessed Anthropic's "Mythos" system via a third-party vendor environment. Details were sparse, but the incident underscored that even frontier labs with significant security investment could be exposed through vendor chains. TechCrunch, citing the WIRED coverage, noted that OpenAI had not paused work with Mercor at the time but was investigating its exposure.
The lawsuits against Mercor moved with unusual speed. Bloomberg Law reported on April 22 that a proposed federal class action had been filed, alleging Mercor and vendors (including LiteLLM's maintainers and a company called Delve) failed to protect personal information. The complaint invoked AIVIA. SC Media and OECD.AI incident trackers noted multiple class actions filed in California and Texas, with numbers ranging from four to seven suits within two weeks of the disclosure.
For context, IBM's Cost of a Data Breach report for 2025, published July 30 of that year, put the global average breach cost at $4.44 million; the U.S. average ran closer to $10.2 million. Those figures didn't account for brand damage, customer churn, or the legal complexity of biometric claims under BIPA—a statute known for generating substantial settlements due to its private right of action.
Competitors and peers in the AI training-data sector were paying attention. Scale AI, despite its larger market position, had faced its own scrutiny over the years, though no public breaches of comparable scope. TELUS International had been fined by South Korea's Personal Information Protection Commission (PIPC) on June 26, 2025, over inadequate safeguards in its data-work operations, per MLex reporting—a signal that global regulators were watching this sector even before Mercor.
The common thread across these incidents wasn't weak passwords or missing firewalls. It was architectural: sensitive data sitting in systems that also interfaced with third-party tooling, often via credentials or tokens that, once compromised, granted broad access. The OWASP Top 10 for Large Language Model Applications included supply-chain risks for models, plugins, and orchestration layers. LiteLLM fit that profile exactly—a convenience layer that many teams adopted without treating it as Tier-1 critical infrastructure.
Three Shifts Ahead
The Mercor breach will likely accelerate changes already underway.
Tighter biometric policies. Illinois AIVIA requires deletion within 30 days on request. BIPA treats voiceprints and facial geometry as protected biometric identifiers, with significant statutory damages for violations. If you're building an AI platform that collects verification video or voice samples—whether for contractor vetting, customer onboarding, or model training—explicit consent flows, data minimization, and documented deletion schedules are no longer optional. The EU AI Act's general application date would impose additional high-risk system obligations on HR and employment tools that use AI to analyze applicants. Colorado's biometric amendments were also phasing in. Waiting for enforcement actions is no longer a viable strategy.
Deeper supply-chain scrutiny. Forrester's predictions anticipated intensified focus on AI and security outcomes, with supply-chain consolidation as a theme. Gartner noted a growing shift of "content risk" responsibilities into AI engineering teams—governance as embedded practice, not afterthought.
Practically, that means pinning builds, verifying packages, monitoring for drift, and treating "AI gateway" dependencies like LiteLLM as critical infrastructure subject to the same controls as your databases or authentication services. NIST's AI Risk Management Framework (version 1.0, January 2023) and Generative AI Profile (AI 600-1, July 2024) lay out cross-sector risk controls that include vendor management and data governance. ISO/IEC 42001:2023, published December 18, 2023, offers a management system standard specifically for AI.
More granular attestations. TechCrunch's April 9 reporting suggested other large model makers were "weighing" their relationships with Mercor, though no names were confirmed. Meta's pause sent a signal. If a multi-billion-dollar vendor can lose terabytes of data through a supply-chain compromise, what does your vendor risk assessment process actually catch?
Expect procurement teams to require detailed maps of where training data sits, who has access, what third-party libraries touch it, and how biometric consent is tracked. The FTC's May 18, 2023, policy statement on biometric information under Section 5 of the FTC Act, and its February 2024 proposed rule on AI impersonation, signal that regulators are thinking about voice misuse as a consumer-protection issue, not just a privacy one.
The Uncomfortable Calculus
For founders, the math is uncomfortable but increasingly clear.
If your business model involves collecting voice, video, or other biometric data at scale—whether you're a labeling platform, a conversational AI company, an identity-verification service, or a talent marketplace—you're now operating in a higher-risk category. That means isolating raw media from operational systems. Segmenting per-client environments. Conducting data protection impact assessments. Stress-testing your incident response plans for supply-chain compromises, not just direct intrusions.
The Mercor breach is unlikely to be the last of its kind. The AI training-data market is projected to grow substantially through the end of the decade, per industry estimates—with much of that growth driven by voice, video, and multimodal datasets. The regulatory scaffolding is still being assembled. The supply chains remain complex and underaudited. And the incentive for attackers is obvious: training data is valuable, portable, and often poorly protected.
Perhaps the real lesson is simpler than any framework document. If you're sitting on terabytes of biometric data, someone else wants it. And as Mercor learned, they're willing to spend three hours compromising a Python package to get it.
