LiteLLM breach data shows supply chain attack impacted 2,488 firms

A new analysis of data allegedly stolen during the March 2026 LiteLLM supply chain attack has linked nearly 2,500 corporate domains to exposed CI/CD environments, including those of major technology, industrial, financial, and telecommunications firms.

Cybersecurity firm Hudson Rock obtained a 153GB RAR archive containing 433,909 files associated with the TeamPCP campaign. After analyzing the material, the company attributed 118,829 CI runner dumps to 2,488 corporate domains, with the records containing environment variables, cloud credentials, API tokens, configuration files, and other secrets collected from affected systems.

The findings provide a clearer picture of the fallout from an attack first disclosed in March. TeamPCP compromised the software supply chain surrounding the Trivy vulnerability scanner, which was subsequently used inside LiteLLM's build environment. According to earlier investigations from Endor Labs, Snyk, Trend Micro, Cycode, and others, this ultimately allowed the attackers to obtain LiteLLM publishing credentials and push malicious LiteLLM versions 1.82.7 and 1.82.8 to PyPI.

LiteLLM is a widely used open-source proxy and Python library that provides a common interface for applications connecting to numerous large language model providers. Its position within AI and development infrastructure makes affected environments particularly valuable, as they can contain cloud credentials, repository tokens, Kubernetes secrets, database passwords, and keys for AI services.

The malicious releases deployed a multi-stage credential stealer, with version 1.82.8 also containing a .pth startup file that could execute when Python initialized without requiring developers to explicitly import LiteLLM. The malware harvested environment variables and local files, including .aws/credentials and .kube/config, attempted lateral movement within Kubernetes, and installed persistence via a systemd service.

Hudson Rock says the recovered data includes AWS secrets, GitLab identities, Salesforce and Slack credentials, Azure secrets, and AI provider API keys. Researchers also noted that attribution can be difficult because CI data may identify a developer's parent company while the affected infrastructure belongs to a subsidiary. Other dumps reportedly contain credentials but no reliable organizational identifiers.

Among the domains Hudson Rock says it has identified are those of AWS, Samsung, Cisco, Salesforce, ServiceNow, S&P Global, Siemens, Deloitte, Epic Games, Orange, BT, and John Deere. These should be treated as researcher-attributed exposures rather than independently confirmed breaches unless the affected companies disclose otherwise.

CloudSEK separately analyzed exposure data from the same broader campaign and reported more than 2,500 potentially affected companies and roughly 434,000 CI/CD pipeline records. Its high-confidence matches include NVIDIA, Cisco, Volkswagen, X, FedEx, Zscaler, Roku, Vodafone, and others. CloudSEK explicitly notes that a high-confidence match indicates evidence connecting an organization or pipeline to the exposure path, not proof of successful exfiltration or later attacker activity.

Both companies have now launched domain-checking portals (Hudson Rock, CloudSEK) that allow organizations to determine whether their infrastructure appears in the datasets.

Organizations that installed LiteLLM 1.82.7 or 1.82.8 should treat credentials accessible to those environments as potentially exposed. Defenders should rotate cloud, source-control, Kubernetes, registry, SaaS, database, and AI API credentials; rebuild affected runners from clean sources; inspect for unauthorized .pth files and the “System Telemetry Service” persistence mechanism; and review cloud, Kubernetes, source-control, and network logs for suspicious activity dating from the March 24 compromise.