A massive leak of 153GB of credentials exposed thousands of corporate domains, including AWS, Samsung, Cisco, and Salesforce, after a LiteLLM supply chain breach.

A massive 153GB data dump of stolen credentials has surfaced online, exposing login details for thousands of corporate domains after a supply‑chain breach in the popular AI‑model serving library LiteLLM.

What happened in the LiteLLM breach

Security researchers discovered that attackers had compromised the build pipeline of LiteLLM, inserting malicious code that harvested authentication tokens from developers’ environments. The stolen data was later exfiltrated and posted on a public file‑sharing site.

Scope of the leaked credentials

The leak includes usernames and passwords, API keys, and session tokens linked to high‑profile companies such as AWS, Samsung, Cisco and Salesforce. While the exact number of affected accounts is not disclosed, the volume of data—over 153 gigabytes—suggests a wide‑reaching impact across multiple industries.

Researchers caution that many of the credentials appear to be still valid, meaning threat actors could potentially gain unauthorized access to cloud resources, internal tools, and customer data.

How organizations can respond

Affected companies should immediately rotate all compromised secrets, enforce multi‑factor authentication, and audit logs for suspicious activity. Security teams are also advised to scan their code repositories for any remnants of the malicious LiteLLM injection.

  • Revoke and regenerate API keys and access tokens
  • Enable MFA on all privileged accounts
  • Conduct a thorough review of third‑party dependencies
  • Monitor for anomalous login attempts

Incident response teams should also consider employing software‑bill of materials (SBOM) tools to track the provenance of open‑source components and detect future supply‑chain compromises earlier.

Supply‑chain attacks on open‑source libraries are becoming increasingly common, and this incident underscores the need for rigorous dependency management.

For a detailed analysis of the breach and recommended mitigation steps, see the coverage by Help Net Security.

Help Net Security coverage of LiteLLM breach