Terabytes of credentials leaked in massive LiteLLM supply-chain attack
A supply-chain attack on the open-source AI tool LiteLLM exposed terabytes of access credentials from more than 2,500 organizations, including Microsoft, Amazon, Cisco and Samsung.
Security firms CloudSEK and Hudson Rock this week revealed that a supply-chain attack on LiteLLM, an open source tool used in AI-driven software development, resulted in terabytes of stolen access credentials. Among the affected organizations are Microsoft, Amazon, Cisco, Samsung and Salesforce.
According to CloudSEK, attackers obtained cloud keys, repository access tokens, SSH keys, Kubernetes secrets, package-publishing credentials and AI provider keys that could grant access to more than 2,500 organizations.
A 40-minute window
The data was harvested in March during a 40-minute period while users downloaded infected versions of LiteLLM from its official location on the Python Package Index. Hudson Rock made its discovery after analyzing a 195TB file it had obtained. Neither firm has identified the source of the leaked data.
The LiteLLM breach stemmed from an earlier supply-chain attack that had infected the widely used vulnerability scanner Trivy. The same campaign also affected the KICS tool and the Telnyx Python SDK. A group called TeamPCP, said to be largely composed of teenagers, has claimed responsibility, and researchers have largely corroborated the claim.
In total, the two firms estimate that roughly 434,000 CI/CD software pipelines had credentials exposed after running the compromised LiteLLM versions. In many cases, researchers were unable to identify which organizations specific credentials belonged to, since much of the data lacked identifying information.
Urgent credential rotation urged
Both firms are urging all organizations that ran the compromised LiteLLM versions 1.82.7 and 1.82.8 to immediately rotate their credentials and treat any secret accessible to the LiteLLM environment as compromised. As a cautionary example, CloudSEK noted that Trivy's developers rotated but failed to fully revoke an automation token for 20 days, giving attackers a window to push malicious code into third-party builds.
Security researcher Kevin Beaumont said some affected organizations are not taking the disclosure seriously enough — one major US tech company claimed it had already rotated all its credentials, but when tested, most of them still worked.
