Mercor.io (LiteLLM) Data Breach Notice (Washington Attorney General): What Was Exposed & What To Do

In a threat landscape where identity documents and government identifiers remain prime targets for criminals, even relatively contained incidents can leave lasting exposure for the people involved. A notice filed with the Washington State Attorney General on June 26, 2026, states that Mercor.io (LiteLLM) experienced a data breach affecting 633 people, with the incident dated March 24, 2026. The filing lists Social Security numbers, driver’s license or Washington ID card numbers, and passport numbers among the information exposed. For those whose records were involved, the combination of high-value identity data and a multi-month gap between the incident and the public notice raises practical questions about monitoring and recovery.

Public detail beyond the Attorney General filing is limited. What is known comes from the organization’s notification to Washington residents and the associated regulatory report. The scale—633 individuals—is modest compared with many large-scale breaches, yet the sensitivity of the named data types means the consequences for affected people can still be significant.

Breaking down the breach

According to the filing reported to the Washington State Attorney General on June 26, 2026, Mercor.io (LiteLLM) notified Washington residents of a data breach. The notice places the incident itself on March 24, 2026. The organization reported that 633 people were affected. Among the information listed as exposed are Social Security numbers, driver’s license or Washington ID card numbers, and passport numbers.

The filing does not describe the technical method of intrusion, the systems involved, how long unauthorized access lasted, or whether data was exfiltrated, viewed, or otherwise misused. No threat actor is named in the available record. Timing between the March 24, 2026 incident date and the June 26, 2026 reporting date is part of the public notice; further operational detail is undisclosed. Readers should treat the Attorney General filing as the authoritative public source for the counts, dates, and data categories above.

How a breach like this happens

Incidents that expose government-issued identifiers and identity documents typically follow familiar patterns, even when the precise path in any one case remains unconfirmed. Attackers often gain an initial foothold through stolen or guessed credentials, phishing that yields employee or contractor access, unpatched software, misconfigured cloud storage or databases, or compromised third-party services that hold customer or applicant data. Once inside, they may search for repositories containing scanned IDs, HR or onboarding files, verification records, or backups that concentrate Social Security numbers and passport details in one place.

In many organizations that handle identity verification or professional onboarding, such records are collected for legitimate compliance, background, or payment purposes. If access controls, encryption at rest, logging, or network segmentation are incomplete, a single compromised account or exposed endpoint can open a path to those files. After data is copied, it may later appear in criminal markets or be used for fraud. None of these general mechanisms is confirmed for this specific incident; they describe how breaches of this data category commonly unfold when technical and process controls fail to contain unauthorized access.

About Mercor.io (LiteLLM)

Mercor.io (LiteLLM), as referenced in the Washington Attorney General filing, operates in a technology context associated with AI and large-language-model tooling. LiteLLM is widely known in the developer community as software that helps applications route and manage calls to multiple language-model providers. Organizations in this sector often handle account information, API-related credentials, professional profiles, and—when they also run hiring, contracting, or identity-verification workflows—government ID and tax identifiers for contractors, applicants, or users.

A breach affecting such an organization is consequential because the data types named in the notice are core identity credentials rather than low-sensitivity marketing lists. Even when the number of people affected is in the hundreds rather than the millions, the combination of Social Security numbers and government photo-ID or passport numbers can support long-term identity fraud. Public background on the sector does not establish how Mercor.io (LiteLLM) stored or protected the specific records in this case; those operational details are not part of the disclosed filing.

What was likely exposed

The Washington Attorney General filing explicitly lists Social Security number, driver’s license or Washington ID card number, and passport number among the information exposed. The notice does not publish a full inventory of every field, file type, or system involved, nor does it confirm whether additional categories—such as names, addresses, email addresses, dates of birth, or financial account details—were also present. Exact contents beyond the named categories remain unconfirmed in the public record.

Organizations that collect government ID and passport data for verification, contracting, or compliance typically also hold associated personal details needed to match those documents to individuals. Because the filing does not itemize every element, it is accurate only to report the three categories named above as exposed and to treat any further assumptions as unverified. Affected individuals should rely on the notice they received from the organization for the most precise description of what applied to them.

What's at stake

For the 633 people reflected in the filing, the primary risk is identity theft and related fraud. Social Security numbers can be used to open credit accounts, file false tax returns, or seek government benefits in someone else’s name. Driver’s license, state ID, and passport numbers strengthen an attacker’s ability to impersonate a person in situations that require government-issued identification, including account takeovers, synthetic identity construction, or attempts to obtain replacement documents. These harms can surface months or years after the initial incident.

For the organization, the stakes include regulatory obligations under state breach-notification laws, potential civil exposure, cost of investigation and remediation, and erosion of trust among users, contractors, or partners who supplied sensitive documents. The filing itself does not assign fault or describe security shortcomings as established fact; it records that a breach occurred, when it was dated, how many people were reported affected, and which high-sensitivity data types were listed. Real-world impact depends on whether the data is later misused and on how promptly individuals and the organization respond.

If your data was in this breach

If you received a notice from Mercor.io (LiteLLM) or believe you may be among the 633 people reported, treat the communication as authoritative for your situation. Place a fraud alert or security freeze with the major credit bureaus, monitor credit reports and tax transcripts for unfamiliar activity, and be cautious of phishing that references this incident. If a driver’s license, state ID, or passport number was involved, follow official guidance from the issuing agency on whether to replace the document or add notations. Keep records of the notice and any reference numbers the organization provided.

You can also run a free exposure scan of your email address to check whether your information has surfaced in known breach data sets. That step does not replace credit monitoring or official notices, but it can help you see whether the same address appears in other publicly reported incidents and prioritize further protections accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.