A supply-chain attack on LiteLLM, an open-source tool for AI development, leaked terabytes of credentials belonging to major organizations including Microsoft, Amazon, Cisco, Samsung, and Salesforce. Security firms CloudSEK and Hudson Rock reported the breach, which exposed cloud keys, repository tokens, SSH keys, Kubernetes secrets, and other sensitive data that could compromise over 2,500 organizations.
The credentials were harvested during a 40-minute window in March from malicious LiteLLM versions downloaded via the Python Package Index. Hudson Rock identified the leak after analyzing a 195TB file; the source of the stolen data remains unknown.
Comments