InfoSecBulletin Cybersecurity for mankind
153GB record surface online stolen during the LiteLLM supply chain attack linked to thousands of corporate domains, including AWS, Samsung, Cisco, and Salesforce. Hudson Rock said the archive has 433,909 files, and linked 118,829 CI runner dumps to 2,488 company domains.
“We are leveraging this data for a global ethical disclosure effort,” Alon Gal, Hudson Rock’s co-founder and CTO, told Help Net Security. “We see this as an opportunity to help organizations respond proactively before threat actors weaponize the data publicly.”
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
On March 19, 2026, TeamPCP, a group of cybercriminals that started in late 2025, used stolen login info to release a hacked version of Trivy. LiteLLM’s build system installed Trivy on its own, giving the bad scanner access to the runner area and letting the attackers take the project’s PyPI publishing keys. TeamPCP released two harmful LiteLLM versions, 1.82.7 and 1.82.8, to the Python Package Index on March 24.
“The key takeaway is how supply chains have evolved to make a single upstream breach affect thousands of companies simultaneously. A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested,” Gal said.
Tracing exposed secrets back to their owners
The data includes details about companies like NVIDIA, Volkswagen, Microsoft, FedEx, S&P Global, John Deere, Epic Games, Orange, TomTom, BT Group, ServiceNow, Deloitte, and Siemens.
Screenshots from the research show secret access keys for AWS, client secrets for Salesforce, signing secrets for Slack, environment variables for Azure, and API keys for AI providers taken during pipeline runs.
CloudSEK estimated from a different dataset that nearly 500 organizations are exposed.
“I’ve confirmed the data is legit by the way, multiple victim orgs,” security researcher Kevin Beaumont said. “It contains a significant volume of sensitive content at orgs. It’s a massive supply chain breach due to poor AI security—not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security.”
“Identifying the victims within this 153GB database presents a unique threat intelligence challenge. Accurate attribution requires looking past the surface level to analyze the actual infrastructure boundaries,” Hudson Rock noted.
A leaked pipeline was connected to a committer email at SiriusXM. Other signs in the same leak, like a self-hosted GitLab found at gitlab.adswizz.com, led to AdsWizz, which is a part of SiriusXM.
Hudson Rock said correct identification depends on “hard infrastructure markers rather than simple committer emails.”
Many of the dumped files do not have a clear owner. Hudson Rock says some have database passwords, third-party API keys, and cloud login details without company emails, custom domains, or server names that show which organization they belong to.
Organizations urged to act before stolen data leaks
Organizations urged to act before stolen data leaks Hudson Rock is asking organizations that use AI proxy tools, third-party security scanners, or AI packages to check their systems for LiteLLM versions 1.82.7 and 1.82.8. They should treat any secrets in the LiteLLM environment as unsafe.
Organizations should change cloud IAM keys and access tokens often. They need to look at audit logs for strange activity since March 24 and find any unauthorized .pth files and suspicious systemd services.
“While we cannot disclose how we obtained this data, it is not leaked anywhere at the moment and is not circulating widely. This makes it a critical window of opportunity for companies to rotate keys and secrets before it eventually leaks, as is the natural cycle of a breach,” Gal added.
Many groups seem to be dealing with the breach less seriously than they should, even though it is significant.
“These creds date from about March. One of the orgs impacted told me they’d rotated them all and it’s a nothingburger, so I looked at their responsible disclosure policy, it allows trying creds, so I tried them all. Almost every one worked. Submitted report. One of the biggest US techcos,” Beaumont wrote.
“This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry,” Gal concluded.
