Mercor said its data breach was the result of a hack of the open source tool LiteLLM. This tool is so popular that it’s downloaded millions of times a day. For 40 minutes, the tool harbored credential harvesting malware — rogue software that could steal login credentials. Those credentials were used to gain access to more software and accounts, which it used to harvest more credentials, and so on.

While there have been no formal acknowledgments of how much data was scooped up from Mercor, there have been repercussions all the same. Meta has paused its contracts with Mercor indefinitely, sources told Wired. (Mercor declined to comment to TechCrunch about this.)

Like other contract AI data training companies, Mercor handles some of the model makers’ biggest trade secrets: the custom data sets and processes they use to teach their models. This is so important to them that even after Meta spent $14.3 billion on Mercor’s competitor Scale AI, it continued working with Mercor.

In a spot of good news for Mercor (maybe…we’ll see): OpenAI also confirmed to Wired that it was investigating its exposure in Mercor’s breach, but said it had not paused or ended its contracts at the time. However, TechCrunch has heard from multiple sources that other large model makers may also be weighing their relationships with Mercor after the breach, although we have not confirmed enough details to name names as of yet.