Massive LiteLLM Supply Chain Attack Exposes 153GB of Stolen Credentials

The LiteLLM supply chain attack has resulted in a significant data breach, with a 153GB archive containing 433,909 files, including sensitive credentials from 2,488 corporate domains. Affected companies include major players like AWS, Samsung, Cisco, and Salesforce. Hudson Rock analyzed the data and revealed that 118,829 CI runner dumps are included, raising concerns about the usability of exposed credentials. This attack has impacted over 2,500 organizations and 434,000 CI/CD pipelines, indicating a widespread security risk. The breach was first reported in March 2026, and the newly surfaced data suggests that the credentials may still be active. Hudson Rock is leveraging this information for a global ethical disclosure effort.

Key Points: • 153GB of sensitive data stolen in the LiteLLM supply chain attack. • The breach affects 2,488 corporate domains, including major companies. • Exposed credentials may still be usable, posing ongoing security risks.