A 153GB archive of credentials taken during the March 2026 LiteLLM supply chain attack has surfaced. Security firms Hudson Rock and CloudSEK analyzed the data and reported exposure connected to nearly 2,500 organizations, including Amazon, Samsung, Cisco, Microsoft, NVIDIA, and Salesforce.

The attack reportedly lasted about 40 minutes, yet it collected secrets from more than 430,000 CI/CD pipelines. The archive contains sensitive data tied to CI runner environments and corporate domains.

How the LiteLLM Supply Chain Attack Happened

The incident was linked to TeamPCP, a cybercriminal group that emerged in late 2025. On March 19, 2026, the group used stolen credentials to publish a compromised version of Trivy, an open-source vulnerability scanner.

LiteLLM’s build pipeline automatically installed Trivy. That gave the compromised scanner access to the runner environment, where attackers obtained the project’s PyPI publishing tokens.

TeamPCP then used those tokens to publish two malicious LiteLLM packages to the Python Package Index on March 24:

  • LiteLLM version 1.82.7
  • LiteLLM version 1.82.8

The malicious releases collected environment variables, AWS credentials, Kubernetes configurations, SSH keys, and AI provider API keys. The data was then sent through infrastructure controlled by the attackers.

Scope of the Exposed LiteLLM Credentials

Hudson Rock linked 118,829 CI runner dumps to 2,488 corporate domains. CloudSEK reviewed a separate dataset and identified more than 2,500 organizations that may have been affected.

The two firms described their findings as evidence of exposure, not confirmation that every organization suffered a breach.

Organizations connected to exposed credentials include:

  • Amazon
  • Samsung
  • Cisco
  • Microsoft
  • NVIDIA
  • Salesforce
  • Volkswagen
  • FedEx
  • Deloitte
  • ServiceNow
  • S&P Global
  • Siemens
  • BT Group

The presence of an organization in the data does not, by itself, confirm that its systems were breached. It indicates that credentials or related data may have been exposed through the affected LiteLLM releases and CI environments.

Why Credential Rotation Remains Urgent

Months after the initial compromise, some exposed credentials may still be active. Independent security researcher Kevin Beaumont reported that a major U.S. technology company said it had rotated all affected keys. However, when Beaumont tested the keys under the company’s responsible disclosure policy, he found that almost all of them still worked.

Hudson Rock co-founder Alon Gal said the data was not yet publicly circulating. That leaves a limited opportunity for organizations to rotate keys and secrets before the archive potentially becomes more widely available.

Organizations with secrets accessible to LiteLLM versions 1.82.7 or 1.82.8 are being urged to treat those secrets as compromised.

The available reporting points to several immediate steps:

  • Rotate keys, tokens, and other secrets accessible to LiteLLM 1.82.7 or 1.82.8.
  • Rebuild CI runners that may have used the malicious releases.
  • Review logs dating back to March 24.
  • Check CI/CD environments for exposed environment variables, AWS credentials, Kubernetes configurations, SSH keys, and AI provider API keys.

The incident began with a compromised dependency in a build pipeline, then moved through stolen publishing tokens to malicious LiteLLM releases. That chain gave the attackers access to sensitive material stored in runner environments.