Credentials for thousands of organizations exposed in LiteLLM supply-chain attack

A supply-chain attack on LiteLLM, an open-source tool designed to streamline AI-driven software development, resulted in the exfiltration of terabytes of credentials and sensitive data from over 2,500 users. The compromised versions of LiteLLM—distributed via the Python Package Index—were active for a 40-minute window in March 2026, during which attackers scraped and exfiltrated data from infected machines.

Security firms CloudSEK and Hudson Rock independently reported the breach, with Hudson Rock analyzing a 195TB file containing the exposed data. The compromised versions of LiteLLM contained code that accessed the memory of infected machines, scraped its contents, and transmitted the data through attacker-controlled channels. The exposed data included cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys.

Among the organizations whose credentials were exposed are Microsoft, Amazon, Cisco, Samsung, Salesforce, Nvidia, AWS, Siemens, Airbus, and multiple other major corporations and institutions. Researchers noted that many of the exposed credentials lacked identifiable company-specific markers, making it difficult to attribute them to specific organizations. For example, an email address from the domain @siriusxm.com was traced to a subsidiary, AdsWizz, rather than the satellite broadcaster itself.

The attack was attributed to TeamPCP, a hacking group largely composed of teenagers, which also claimed responsibility for compromising the Trivy vulnerability scanner, KICS, and the Telnyx Python SDK in a broader campaign. The LiteLLM compromise originated from the earlier Trivy supply-chain attack, illustrating how cascading vulnerabilities in AI-adjacent tools can amplify the impact of such breaches.

The exposed data included 434,000 CI/CD pipeline credentials, with researchers warning that many organizations remain unaware of their exposure. Hudson Rock urged organizations using AI proxy infrastructure, third-party CI/CD vulnerability scanners, or downstream AI packages to audit their environments for LiteLLM versions 1.82.7 and 1.82.8, the compromised releases. The firm recommended aggressive credential revocation, including rotating cloud keys, Kubernetes service account tokens, and GitLab/GitHub personal access tokens (PATs).

The incident underscores broader concerns about the security of AI development tools and the rush to integrate AI into software delivery systems. Independent security researcher Kevin Beaumont noted that poor DevOps security practices, particularly in organizations prioritizing rapid AI adoption, exacerbated the scale of the breach. Beaumont also reported that at least one major US technology company had failed to fully rotate exposed credentials despite claiming to have done so, highlighting the challenges of effective incident response.