Two security firms have now put a number on the damage from the March supply chain attack against LiteLLM, the open source gateway that many AI teams rely on to reach large language model providers. CloudSEK and Hudson Rock, which published their findings on August 11 and 12, estimate that credentials stolen during a roughly 40-minute exposure window in March can be traced to 2,500-plus organizations and roughly 434,000 CI/CD pipelines. Hudson Rock said it worked from a 195-terabyte file of stolen data.
LiteLLM is a dependency in countless AI projects because it fronts access to most major LLM providers. In March, unknown attackers published two poisoned builds of the package, versions 1.82.7 and 1.82.8, on the official Python Package Index repository. The code inside those builds inspected the memory of any machine where the package executed, gathered its contents, and sent the results to servers controlled by the attackers. PyPI removed both versions about 40 minutes after the first reports surfaced.
What the attackers harvested, per the two firms, was a broad sweep of secrets: API keys for AI providers, cloud credentials for AWS, Google Cloud and Azure, SSH keys, tokens for source repositories, Kubernetes secrets, environment variables, and credentials used to publish packages. Pipelines that automate software builds, tests and deployments are prime targets because they usually run with wide privileges and install dependencies automatically; that combination let a brief publication window spread the malicious code far.
Both firms were careful to distinguish exposure from breach. CloudSEK called its figures reconstructed exposure, noting that an organization appearing in the dataset does not prove its systems were compromised or that its secrets were all taken. Kevin Beaumont, an independent security researcher who examined the material, said he had verified the data as authentic for several victim organizations and attributed the scale of the incident to rushed AI deployments and weak DevOps hygiene rather than to anything exotic about the attack.
Mapping the data to specific victims was itself difficult. The researchers said an address tied to the siriusxm.com domain turned out to belong not to SiriusXM itself but to its AdsWizz advertising subsidiary.
The names the firms said they could match with high confidence include Nvidia, AWS, Samsung, Salesforce and Cisco, along with ServiceNow, Siemens, Regeneron Pharmaceuticals, Accenture Federal Services and others. Microsoft, Amazon and the London Stock Exchange Group also appear, along with FedEx, Volkswagen, Orange, HP and Deutsche Bahn, as do NGINX and Zscaler.
The March incident grew out of an earlier compromise. Attackers who had stolen a maintainer’s credentials from Trivy, a popular vulnerability scanner, reused them to backdoor LiteLLM, the Checkmarx KICS scanning action and the Telnyx Python SDK. A group calling itself TeamPCP claimed responsibility, a claim researchers have broadly backed, and press reports characterize its members as mostly teenagers.
The case has drawn official attention. An FBI flash alert and advisories from Aqua Security, Checkmarx, LiteLLM developer BerriAI, Unit 42 and Sophos all cover pieces of the campaign.
The guidance for affected organizations is blunt: assume every secret on infected machines is exposed, rotate credentials and audit downstream systems. CloudSEK’s broader warning is that a poisoned package may vanish from a registry within minutes while the credentials it collected stay valid for weeks or months, and that AI infrastructure, with its gateways, agents and model endpoints, now ranks among the most attractive targets for supply chain attackers.
Sources: Terabytes of credentials leaked in massive supply-chain attack (Ars Technica, Aug 2026); 2,500+ Companies and 434,000 CI/CD Pipelines Exposed (CloudSEK, Aug 2026); Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack (SecurityWeek, Aug 2026); LiteLLM Breach Exposed 434,000 Pipelines Inside 40 Minutes (Cybersecurity Intelligence, Aug 2026)