Massive LiteLLM Breach Exposes Secrets From 2,500 Companies

A massive 153GB archive stolen during the LiteLLM supply chain attack has exposed hundreds of thousands of sensitive files containing cloud credentials, API tokens, and internal secrets tied to nearly 2,500 corporate domains.

The dataset, quietly obtained and analyzed by Hudson Rock, reveals the scale of a breach that began with a poisoned dependency and ended with secrets harvested from organizations across technology, automotive, finance, logistics, gaming, and telecommunications sectors.

Hudson Rock says the archive contains 433,909 files, including 118,829 CI runner dumps linked to 2,488 corporate domains. The company is using the data for what it calls a global ethical disclosure effort, urging affected organizations to rotate credentials before threat actors weaponize the information. The breach traces back to LiteLLM, an open-source proxy gateway used to route developer requests to different AI models. LiteLLM’s build pipeline automatically installed Trivy, a popular open-source vulnerability scanner. On March 19, 2026, the cybercriminal group TeamPCP used stolen credentials to publish a compromised version of Trivy, giving the poisoned scanner read access to LiteLLM’s runner environment and allowing attackers to steal PyPI publishing tokens.

With those tokens, TeamPCP pushed two malicious LiteLLM releases—versions 1.82.7 and 1.82.8—to the Python Package Index on March 24. The window of exposure lasted roughly 40 minutes, but that was enough for the poisoned dependency to be installed more than 430,000 times, capturing millions of secrets from CI pipelines around the world. The stolen data includes AWS secret access keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and API keys for multiple AI providers. Screenshots published with the research show credentials belonging to organizations such as NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, John Deere, Epic Games, Orange, TomTom, BT Group, ServiceNow, Deloitte, and Siemens.

CloudSEK, analyzing a separate dataset of roughly 434,000 stolen files, estimates that close to 2,500 organizations were exposed. The company stresses that exposure does not necessarily mean confirmed breaches, but security researchers say the data is real and dangerous. Researcher Kevin Beaumont said the archive contains a significant volume of sensitive content and called it a massive supply chain breach driven by rushed AI adoption and weak DevOps security.

Hudson Rock notes that identifying victims is not straightforward. Many dumps contain database passwords, third-party API keys, and cloud credentials without any company email address, custom domain, or internal server name to indicate ownership. In one case, a leaked pipeline appeared tied to a committer email at SiriusXM, but infrastructure markers pointed instead to AdsWizz, a SiriusXM subsidiary. The company says attribution requires examining hard infrastructure markers rather than simple committer emails, and warns that many organizations may have exposed credentials in the dataset without realizing they are affected.

Hudson Rock is urging organizations using AI proxy infrastructure, third-party CI/CD vulnerability scanners, or downstream AI packages to audit their environments for LiteLLM versions 1.82.7 and 1.82.8 and treat any secrets accessible to the LiteLLM environment as compromised. Companies are advised to rotate cloud IAM keys and access tokens, review audit logs for anomalous activity dating back to March 24, and check for unauthorized .pth files or suspicious systemd services. The researchers say the archive is not publicly leaked yet, creating a narrow window for organizations to act before the data inevitably circulates.

Despite the severity of the exposure, some organizations appear to be responding with less urgency than the situation demands. Beaumont said one major U.S. tech company told him it had rotated all affected credentials, only for him to find that almost every key still worked. He submitted a responsible disclosure report after testing the credentials under the company’s own policy. Hudson Rock’s Alon Gal says the magnitude of the breach pushes the industry into a completely new world regarding the type of response required, warning that the combination of AI-driven development, automated pipelines, and upstream dependency compromises has created a supply chain environment where a single poisoned package can expose thousands of companies in minutes.