Security firms CloudSEK and Hudson Rock disclosed that a supply-chain attack on LiteLLM, an open-source tool for AI development, exposed terabytes of credentials belonging to thousands of organizations, including Microsoft, Amazon, Cisco, Samsung, and Salesforce. The stolen data reportedly includes cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys that could compromise more than 2,500 organizations.
The credentials were harvested during a 40-minute window in March when victims used compromised LiteLLM versions downloaded from the official Python Package Index repository; Hudson Rock said it made the discovery after analyzing a 195TB file. Neither firm identified the source of the breach.
Comments