A massive 153GB archive stolen during the LiteLLM supply chain attack exposes credentials and other sensitive data linked to thousands of corporate domains, including AWS, Samsung, Cisco, and Salesforce.
Hudson Rock says it obtained and analyzed the archive, which contains 433,909 files, and attributed 118,829 CI runner dumps to 2,488 corporate domains.
“We are leveraging this data for a global ethical disclosure effort,” Alon Gal, Hudson Rock’s co-founder and CTO, told Help Net Security. “We see this as an opportunity to help organizations respond proactively before threat actors weaponize the data publicly.”
LiteLLM is an open-source proxy gateway that developers use to route requests to different AI models. The LiteLLM breach had its roots in an earlier compromise of Trivy, a popular open-source vulnerability scanner.
On March 19, 2026, TeamPCP, a cybercriminal group that emerged in late 2025, used stolen credentials to publish a compromised version of Trivy. LiteLLM’s build pipeline installed Trivy automatically, giving the poisoned scanner read access to the runner environment and allowing the attackers to steal the project’s PyPI publishing tokens.
Using those tokens, TeamPCP published two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, to the Python Package Index on March 24.
“The key takeaway is how supply chains have evolved to make a single upstream breach affect thousands of companies simultaneously. A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested,” Gal said.
Tracing exposed secrets back to their owners
The dataset contains information linked to organizations including NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, John Deere, Epic Games, Orange, TomTom, BT Group, ServiceNow, Deloitte, and Siemens.
Screenshots published with the research show AWS secret access keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys captured during pipeline execution.
A trove of internal corporate secrets (Source: Hudson Rock)
CloudSEK, working from a separate dataset built from about 434,000 stolen files, put the number of exposed organizations at close to 2,500. The company stressed that its figures reflect exposure rather than confirmed breaches.
“I’ve confirmed the data is legit by the way, multiple victim orgs,” security researcher Kevin Beaumont said. “It contains a significant volume of sensitive content at orgs. It’s a massive supply chain breach due to poor AI security—not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security.”
“Identifying the victims within this 153GB database presents a unique threat intelligence challenge. Accurate attribution requires looking past the surface level to analyze the actual infrastructure boundaries,” Hudson Rock noted.
In one case, a leaked pipeline was tied to a committer email at SiriusXM, but infrastructure markers in the same dump, including a self-hosted GitLab instance at gitlab.adswizz.com, pointed to AdsWizz, a SiriusXM subsidiary.
Hudson Rock said correct identification depends on “hard infrastructure markers rather than simple committer emails.”
A large share of the dumped files have no obvious owner. According to Hudson Rock, some contain database passwords, third-party API keys, and cloud credentials without a company email address, custom domain, or internal server name that could identify the organization they came from.
This means organizations may have exposed credentials in the dataset without knowing they are affected.
Organizations urged to act before stolen data leaks
Hudson Rock is urging organizations using AI proxy infrastructure, third-party CI/CD vulnerability scanners, or downstream AI packages to audit their environments for LiteLLM versions 1.82.7 and 1.82.8 and treat any secrets accessible to the LiteLLM environment as compromised.
Organizations should also rotate cloud IAM keys and access tokens, review audit logs for anomalous activity dating back to March 24, and check for unauthorized .pth files and suspicious systemd services.
“While we cannot disclose how we obtained this data, it is not leaked anywhere at the moment and is not circulating widely. This makes it a critical window of opportunity for companies to rotate keys and secrets before it eventually leaks, as is the natural cycle of a breach,” Gal added.
Despite the scale of the breach, some organizations appear to be treating the exposure with less urgency than the findings warrant.
“These creds date from about March. One of the orgs impacted told me they’d rotated them all and it’s a nothingburger, so I looked at their responsible disclosure policy, it allows trying creds, so I tried them all. Almost every one worked. Submitted report. One of the biggest US techcos,” Beaumont wrote.
“This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry,” Gal concluded.