Mercor Data Breach: What Was Taken, Who Was Told, Where the Lawsuit Stands
Questions about this case?
Free · answers in seconds · general information, not legal advice
Mercor pays specialists — scientists, doctors, lawyers and others it calls “experts” — to train AI models. Between March 24 and 30, 2026, an intruder got into some of its systems through a tampered version of LiteLLM, an open-source tool Mercor used. Formal notices went out by email on June 25 and 26, 2026, with 24 months of free credit monitoring; the notice set the enrollment deadline at October 1, 2026. Seven class actions are now one federal case, paused since July 21, 2026 for mediation. There is no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened in the Mercor Hack
Mercor's account. In March 2026, a malicious actor published compromised versions of LiteLLM designed to steal credentials from any system that installed them. Mercor says this gave the intruder access to some of its systems between March 24 and 30, 2026, that it “quickly detected and blocked the activity,” and that data was downloaded. It confirmed the incident on March 31, 2026, calling itself “one of thousands of companies” hit by the LiteLLM compromise. Its June 25 update says that of “nearly five million experts, only a very limited subset had sensitive information affected,” that no employee data was affected, and that there is no evidence of fraudulent use.
What the hackers claimed. An extortion group claimed the attack the same week. According to the consolidated complaint, which cites news reports, the group claimed 4 terabytes of data — 939 GB of source code, a 211 GB user database and about 3 TB of video interview recordings and identity-verification documents — and offered it for sale in a dark-web auction. Mercor's own statements do not confirm those figures.
What the lawsuits say. The plaintiffs allege Mercor collected passport and ID scans, Social Security numbers, W-9 tax details, interview recordings, resumes and screenshots of workers' screens, and failed to protect them. They also fault the first email notice for saying nothing about what data was taken.
Case Details
On May 19, 2026, U.S. District Judge William H. Orrick consolidated seven proposed class actions into In re Mercor.io Corporation Data Breach Litigation, lead case No. 3:26-cv-02821-WHO in the U.S. District Court for the Northern District of California. The first-filed case, Deboni v. Mercor.io Corporation, was filed on April 1, 2026. On June 18, 2026, the plaintiffs filed one Consolidated Class Action Complaint against Mercor. It pleads negligence, breach of implied contract and unjust enrichment for a nationwide class, and invasion of privacy under the California Constitution, the California Consumer Privacy Act and the Unfair Competition Law for a California subclass.
A separate Mercor lawsuit over the same breach, White v. Delve Technologies, Inc., No. 6:26-cv-00143 (N.D. Tex.), also named Mercor and LiteLLM's developer. The two plaintiffs dropped their own claims against both in June 2026 and against Delve when the court closed the case on September 4, 2026. Only their individual claims were dismissed with prejudice; no class was ever certified, and the proposed class claims against Delve were dismissed without prejudice — so the case did not cost anyone else their claims.
Status: Paused for Mediation, No Settlement
As of September 30, 2026, we found no settlement announcement and no settlement filing. That means no fund, no administrator, no claim form and no claim deadline. Mediation can end in a settlement or in a return to litigation.
Don't miss the claim deadline
Claims are due by October 1, 2026. We'll email you 7 days and 1 day before the deadline.
Who Is in the Proposed Class
The consolidated complaint proposes a nationwide class of “all United States residents whose Private Information was actually or potentially accessed during the Mercor Data Breach,” including everyone who received notice, plus a California subclass. No class has been certified yet. You do not sign up for a class action; if the case settles, a court-appointed administrator contacts class members.
The practical test is your inbox. Mercor sent its formal notices by email on June 25 and 26, 2026, from mercor@notifications.cyberscout.com. That notice lists which of your details were downloaded and carries your personal activation code. The first email, sent on or about March 31 according to the lawsuits (“early April” in Mercor's own words), only said an incident was under investigation. If you had a Mercor account but find no June email (check spam too), that fits Mercor's statement that only “a very limited subset” of its experts had sensitive information affected.
Is There Money? Not Yet
Two routes could lead to money later. The class action could settle in mediation — a settlement would come with its own official notice, claim form and deadline. Separately, Mercor's Terms of Service say an expert's arbitration terms come from their contractor or worker agreement, and at least one claims company says it and partner law firms are bringing individual arbitration claims for contractors instead of joining the class action. Those outcomes are private and case by case. For how data breach settlements are usually structured, see our data breach settlement calculator.
Mercor Breach Timeline
- 1
March 24–30, 2026 — The Intrusion
Malware inserted into LiteLLM gives an intruder access to some Mercor systems. Mercor says it detected and blocked the activity, but data was downloaded.
- 2
March 31, 2026 — Mercor Confirms, Hackers Claim
Mercor confirms it was one of thousands of companies hit. An extortion group claims it took Mercor data. Mercor also begins emailing experts that it is investigating an incident — on or about March 31 according to the lawsuits, in “early April” according to Mercor's June notice.
- 3
April 1, 2026 — The First Lawsuits
Deboni, Esson and Gill are filed in federal court in Northern California. Four more follow by April 21.
- 4
May 19, 2026 — Seven Cases Become One
Judge William H. Orrick consolidates them as In re Mercor.io Corporation Data Breach Litigation, No. 3:26-cv-02821-WHO. One consolidated complaint follows on June 18.
- 5
June 25–26, 2026 — Formal Notices Go Out
Mercor emails affected experts and offers 24 months of TransUnion credit monitoring (enroll by October 1, 2026). Texas lists 2,025 affected residents, Washington 633.
- 6
July 21, 2026 — Case Paused for Mediation
The court stays all proceedings while the parties mediate. As of September 30, 2026, no settlement has been announced.
Three Things to Watch For
A breach involving ID numbers — and, by the hackers' claim, interview videos — hands scammers unusually good material:
“Claim your Mercor settlement” pages
There is no settlement and no claims portal. A site asking for your Social Security number or a passport scan to “secure your payment” is collecting data, not filing anything.
Fake monitoring or “code reactivation” emails
The real notices came from mercor@notifications.cyberscout.com and point to bfs.cyberscout.com/activate. The service is free and the notice asks for no payment. If a message offers to revive an expired code for a fee, call the number printed in the notice, 1-844-507-8047, instead of clicking.
Project offers that already know your profile
If your resume, ID or interview video is among the data the hackers claim to hold, a stranger can sound exactly like a Mercor recruiter. Open new offers by logging in at mercor.com yourself, and never re-send ID scans or your SSN by email or chat.
Mercor Breach — Questions People Actually Ask
Was I affected by the Mercor data breach?
Look for an email dated June 25 or 26, 2026 from mercor@notifications.cyberscout.com headed “Notice of Data Breach.” It lists which of your details were downloaded and contains your activation code. Mercor says only “a very limited subset” of its nearly five million experts had sensitive information affected, and no employee data.
How many people were affected?
Mercor has not published a total. State filings list 2,025 Texans (Texas Attorney General) and 633 Washington residents (Washington Attorney General). ClaimDepot, a site that compiles state breach filings, puts the total at 21,677. The consolidated complaint, citing news reports, refers to approximately 40,000 contractors; Mercor has not confirmed that figure.
What data did the Mercor hack expose?
Confirmed in state filings: names, addresses, dates of birth, Social Security numbers, driver's license numbers and other government ID numbers such as passport numbers. Your own notice says which applied to you. Claimed by the hackers but not confirmed by Mercor: platform source code, a user database and about 3 TB of video interview recordings and identity-verification documents.
Is there a Mercor class action settlement or claim form?
No. As of September 30, 2026, the consolidated Mercor class action (No. 3:26-cv-02821-WHO) has been paused since July 21, 2026 for mediation, and no settlement has been announced. A site offering a “Mercor settlement claim” today is describing something that does not exist. Settlements that are taking claims are on our open class action settlements list.
Is the Mercor breach email real?
The genuine notice came by email on June 25 or 26, 2026 from mercor@notifications.cyberscout.com, sends you to https://bfs.cyberscout.com/activate, and lists a call center at 1-844-507-8047 (8 a.m. to 8 p.m. ET, Monday to Friday). Compare yours with the sample notice Mercor filed with the California Attorney General. If anything differs, type the address yourself rather than clicking.
What should I do right now?
If you got the notice, its enrollment deadline is October 1, 2026, and the notice says the code stops working after that date. If that date has not passed, enroll at bfs.cyberscout.com/activate now; if it has, call the number in the notice, 1-844-507-8047, and ask whether you can still enroll. The monitoring watches one bureau, so also freeze your credit at Equifax, Experian and TransUnion; bureaus may not charge for it, and it is reversible. Keep the notice email: it is your proof of membership if the case settles.
Does Mercor's arbitration clause affect the Mercor lawsuit?
Possibly, but nothing has been decided. Mercor's Terms of Service (last updated August 26, 2026) contain a mandatory individual arbitration provision with a class-action waiver, but state that this provision does not apply to experts: for them, the arbitration terms of their Expert Independent Contractor Agreement or Worker Agreement control instead. Mercor's deadline to respond to the consolidated complaint (August 3, 2026) was stayed on July 21, 2026, before it came due.
Is there a separate Mercor lawsuit over contractor pay?
Yes. White v. Mercor.io Corporation, No. 6:26-cv-00201 (N.D. Tex.), filed May 8, 2026, argues that Mercor misclassifies its experts as independent contractors. It seeks a nationwide class of people paid for AI-training and related work through Mercor since January 1, 2024, with claims under 26 U.S.C. Section 7434, contract law and ERISA. As of September 30, 2026, the latest entry we found in the public CourtListener archive is a July 31, 2026 order on a motion to extend a filing deadline. A trade-secrets suit by Scale AI (No. 3:25-cv-07402, N.D. Cal.) is a dispute between companies; experts get nothing from it. For what the public record shows about Mercor as a company, see Is Mercor legit?
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Data Breach Settlement Calculator
How breach settlements are usually split, and what yours might be
Open Class Action Settlements
Settlements taking claims right now, with their deadlines
TriZetto Data Breach Lawsuit
Another vendor breach: consolidated federal case, no settlement
Kroll Settlement Administration
How a real settlement administrator contacts class members