A substantial archive of 153GB containing credentials and other sensitive information, reportedly stolen during a supply chain attack involving the open-source proxy gateway LiteLLM, has surfaced. The data is linked to thousands of corporate domains, including major entities like AWS, Samsung, Cisco, and Salesforce.
Hudson Rock, a cybersecurity firm, claims to have obtained and analyzed the archive, which comprises 433,909 files. Their analysis attributes 118,829 CI runner dumps to 2,488 distinct corporate domains. The firm has initiated a global ethical disclosure effort to assist organizations in proactively responding to the exposure before the data is potentially weaponized by threat actors.
LiteLLM, an open-source proxy gateway utilized by developers to route requests to various AI models, was compromised following an earlier breach of Trivy, a widely used open-source vulnerability scanner. On March 19, 2026, the cybercriminal group TeamPCP, which emerged in late 2025, allegedly used stolen credentials to publish a malicious version of Trivy.
LiteLLM's build pipeline automatically installed Trivy, granting the poisoned scanner read access to the runner environment. This access allowed the attackers to steal LiteLLM's PyPI publishing tokens. Leveraging these tokens, TeamPCP subsequently published two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, to the Python Package Index on March 24.
The exposed dataset includes information tied to organizations such as NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, John Deere, Epic Games, Orange, TomTom, BT Group, ServiceNow, Deloitte, and Siemens. Screenshots accompanying the research reportedly show AWS secret access keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys captured during pipeline execution.
Another cybersecurity firm, CloudSEK, working with a separate dataset of approximately 434,000 stolen files, estimates the number of exposed organizations to be close to 2,500. CloudSEK emphasizes that these figures represent potential exposure rather than confirmed breaches.
Identifying the specific owners of the exposed secrets presents a challenge. Hudson Rock notes that accurate attribution requires analyzing infrastructure boundaries beyond surface-level indicators. For instance, a leaked pipeline might be linked to a committer email at one company, but infrastructure markers in the same data dump could point to a subsidiary. A significant portion of the dumped files lack clear ownership, containing database passwords, third-party API keys, and cloud credentials without identifying company email addresses, custom domains, or internal server names. This means some organizations may have exposed credentials without being aware of their compromise.
Hudson Rock is urging organizations that use AI proxy infrastructure, third-party CI/CD vulnerability scanners, or downstream AI packages to audit their environments for LiteLLM versions 1.82.7 and 1.82.8. Any secrets accessible to the LiteLLM environment should be considered compromised. Recommended actions include rotating cloud IAM keys and access tokens, reviewing audit logs for anomalous activity dating back to March 24, and checking for unauthorized .pth files and suspicious systemd services.
Despite the scale of the exposure, some organizations reportedly appear to be addressing the findings with less urgency than warranted. One major US tech company, for example, claimed to have rotated all affected credentials, yet subsequent testing by a security researcher found many of them still active.
Hudson Rock states that the data is not currently circulating widely, presenting a critical window of opportunity for companies to rotate keys and secrets before a wider leak occurs. The firm emphasizes that the magnitude of this incident necessitates a new level of response from the cybersecurity industry.
