A threat actor claims to be selling data allegedly linked to Mercor.com, described as an AI recruiting platform. The group behind the claim is LAPSUS$, the notorious extortion collective responsible for a string of high-profile intrusions against major tech companies.

According to threat intelligence researcher Dominic Alvieri, Mercor AI has allegedly been breached by LAPSUS$, with 939GB of source code and 4TB of data in total stolen — all accessed through their Tailscale VPN.

What Was Allegedly Stolen

The claimed dataset includes:

  • Approximately 211GB of database content
  • 939GB of source code
  • Approximately 3TB of storage bucket data (video, verification, and internal assets)
  • Access via Tailscale VPN
  • Total claimed size: roughly 4TB

The listing is posted as a “Live Auction” — meaning the data has not yet been publicly dumped but is actively being sold to vetted buyers.

LAPSUS$ claims Mercor has over $500M in revenue — an assertion that has not been independently verified.

Who Is Mercor?

Mercor raised a $100M Series B at a $2B valuation in February 2025. The platform sits squarely in the AI talent economy.

Mercor is an AI-powered platform that connects elite global talent with remote job opportunities, using AI to vet and match candidates, while also providing companies with essential human data for training and evaluating advanced AI models through Reinforcement Learning with Human Feedback (RLHF).

That dual mission — talent marketplace plus RLHF data collection — makes this breach particularly alarming. The platform holds video interview recordings, candidate identity verification materials, and potentially sensitive AI training datasets collected from thousands of job seekers globally.

The Attack Vector: Tailscale VPN

The reported access vector is Tailscale, the zero-trust mesh networking tool widely used by startups and AI companies to connect internal infrastructure. If confirmed, this would mean attackers gained access to Mercor’s internal network fabric — potentially granting lateral movement across databases, source repositories, and storage buckets in a single intrusion.

This breach also coincides with a broader LAPSUS$-linked campaign. What started as a supply chain attack on Trivy, a widely used security scanner, has become a LAPSUS$-linked extortion campaign, with more than 1,000 enterprise SaaS environments already compromised, according to Mandiant CTO Charles Carmakal at a Google-hosted threat briefing alongside RSA Conference 2026.

What This Means for Victims

Mercor’s platform stores exceptionally sensitive data:

  • Candidate video interviews (AI-analyzed, biometric-adjacent)
  • Identity verification documents (government IDs, work authorization)
  • Resumes and skills assessments from global talent pools
  • Proprietary source code for AI matching and vetting systems
  • Internal business data and client relationships

Job seekers who completed Mercor’s AI interview process — which involves a roughly 20-minute AI interview — are potentially exposed, along with employer clients across the AI and tech sectors.

Status & Response

As of publication, Mercor has not issued a public statement acknowledging the breach. The data is listed as a live dark web auction, meaning it has not necessarily been publicly dumped yet — though samples may have been shared with vetted buyers.

Bottom Line

This is a Category 1 breach in progress. The combination of source code, biometric-adjacent video data, identity documents, and full infrastructure access via VPN makes this potentially one of the most damaging AI-sector breaches of 2026. The LAPSUS$ live auction format signals an active monetization campaign — meaning pressure on Mercor to pay is likely ongoing.

If you have a Mercor account — candidate or employer — assume your data is compromised until proven otherwise.

⚠️ This story is developing. Check back for updates as Mercor responds and threat intelligence firms publish further analysis.