Massive supply-chain attack on LiteLLM leaks terabytes of credentials from Microsoft, Amazon, and more

A supply-chain attack on LiteLLM, an open-source tool for streamlining AI-driven software development, has leaked terabytes of credentials belonging to some of the world's largest organizations. Security firms CloudSEK and Hudson Rock revealed the breach on Tuesday and Wednesday, reporting that cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys were exposed, potentially affecting more than 2,500 organizations.

The credentials were harvested during a 40-minute window in March when victims used compromised versions of LiteLLM downloaded from PyPI, the official Python package repository. Hudson Rock obtained a 195TB file containing the data. The attack originated from a previous compromise of the widely used vulnerability scanner Trivy, and also infected KICS and the Telnyx Python SDK. A group called TeamPCP, reportedly composed largely of teenagers, has taken credit.

Independent security researcher Kevin Beaumont confirmed the data's legitimacy, saying, "I've confirmed the data is legit by the way, multiple victim orgs. It's a massive supply chain breach due to poor AI security—not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security."

The compromised packages contained code that accessed machine memory, scraped its contents, and exfiltrated it. Approximately 434,000 CI/CD pipelines had credentials exposed. Identifying affected organizations proved challenging, as many credentials lacked identifiable company information. For example, an email from @siriusxm.com led to a breach at SiriusXM subsidiary AdsWizz, not the satellite broadcaster itself.

Hudson Rock noted, "Many CI/CD pipelines are configured generically. The dumped variables contain active database passwords, third-party API keys, and cloud credentials without any identifiable company email, custom domain string, or internal server name. This means countless organizations currently have active secrets sitting in this database, completely unaware of their exposure."

Both firms urge all organizations that used compromised LiteLLM versions—particularly those listed as high-confidence—to aggressively rotate all credentials. Hudson Rock advises assuming any secret accessible to the LiteLLM environment is compromised, rotating cloud keys, Kubernetes service account tokens, and GitLab/GitHub PATs, and auditing logging and egress filtering.

A cautionary example: Trivy developers rotated but failed to fully revoke an automation token over 20 days, giving attackers a window to force-push malicious code to third-party builds.

Already, some affected organizations appear to be underreacting. Beaumont reported that one org called the breach a "nothingburger," but when he tried their credentials, nearly all worked. He submitted a responsible disclosure report.

The breach underscores how supply chains have evolved so a single upstream compromise affects thousands of companies. As Alon Gal, Hudson Rock's CTO, put it, "A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested. This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry."

For developers, this is a wake-up call: audit your dependencies, rotate credentials aggressively, and never assume a "minor" compromise is contained.