LiteLLM Supply Chain Attack: TeamPCP Hackers Stole Keys and Secrets of Over 2,500 Companies

In the aftermath of a supply chain attack on the open-source LiteLLM project, data belonging to more than 2,500 organizations was compromised. Among the affected parties, according to available information, are Cisco, Samsung, Salesforce and Amazon Web Services, as well as Airbus U.S. Space & Defense, Thales Group, Deutsche Bahn, Munich Re and London Stock Exchange Group. The incident has become one of the largest in the cybersecurity sphere in recent months and affected not only corporate information but also critical service secrets.

Attack Mechanism: A Fake Trivy Package

LiteLLM is an open-source gateway that translates API calls for more than a hundred large language models into a single OpenAI-compatible format. Notably, LiteLLM itself was not directly compromised: the immediate target of the attackers was the Aqua Security Trivy security module, designed for vulnerability scanning. According to the investigation, the attack was carried out by hackers from the TeamPCP group: a modified Trivy package was uploaded to LiteLLM without identity verification, which allowed the attackers to gain administrator privileges on the server and install malware.

Exactly What Was Stolen: Keys Are More Valuable Than Data

The installed malware compromised credentials and secrets that experts consider far more valuable than the corporate information itself. Among the stolen items are SSH and cloud resource keys, Kubernetes tokens, environment variables, repository publishing tokens, as well as AI provider keys. According to CloudSEK, the resources of 2,500 companies and 434,000 CI/CD pipelines — software development projects — were compromised. Hudson Rock examined a 195 TB dump of stolen data and published a 153 GB archive of materials.

Timeline and Verification Tools

CloudSEK and Hudson Rock experts determined that the attack was deployed on March 24, yet the issue remained unresolved even five months after the incident. Both companies launched domain verification tools so that affected organizations could independently assess the extent of their vulnerability online. According to the current date of August 24, 2026, about five months have passed since the attack was deployed, underscoring the length of the period during which the threat persisted.

Contradictory Data

The sources show discrepancies in the scale of the incident. The main text and a number of publications (including 3dnews.ru, cpomagazine.com and securityweek.com) cite more than 2,500 affected organizations, whereas The Hacker News, in its article, uses the figure of "more than 2,100 organizations." Differences in estimates may be linked to varying counting methodologies and the points in time at which data was captured. Moreover, although the companies claim to have replaced the credentials, some of the compromised keys reportedly remain valid to this day, and there is no guarantee that organizations will re-verify the workings of their AI systems.

Privacy Consequences

The compromised keys and tokens may put at risk the data privacy of both the affected organizations themselves and their clients. Experts emphasize that the leak of service secrets — SSH keys, Kubernetes tokens and environment variables — opens the door to further lateral movement within the infrastructure, making the incident a potentially long-term risk. For the affected companies, the priority becomes not only replacing credentials but also auditing supply chains and the workings of AI systems.