Terabytes of credentials leaked in massive supply-chain attack

LiteLLM, an open source tool used in AI-driven software development, became the centre of a supply-chain security incident that exposed terabytes of credentials. The disclosure was covered by Ars Technica in its security reporting on August 13, 2026. Here’s the thing: this isn’t just about one tool being compromised—it’s about how stolen secrets can cascade across cloud accounts, repositories, and AI integrations at scale.

CloudSEK and Hudson Rock both pinned their findings to credentials that were harvested during a short window in March, using compromised LiteLLM packages obtained from the Python Package Index location. That sequence matters for defenders because it means the attacker effectively “stored access,” then replayed it later through stolen keys and tokens.

What happened on August 13, 2026—who leaked credentials and where did they come from?

The incident was tied to LiteLLM, an open source component used to streamline AI-focused software development workflows. According to Ars Technica coverage, the exposed material included access secrets belonging to major organizations such as Microsoft, Amazon, Cisco, Samsung, and Salesforce. The reports that surfaced on Tuesday and Wednesday were attributed to security firms CloudSEK and Hudson Rock, which analysed large datasets to identify what kinds of secrets were captured.
The key timeline detail is that the credentials were extracted during a 40-minute window in March while victims installed compromised LiteLLM versions from the Python Package Index. That detail explains why the breach could sit unnoticed for weeks: supply-chain compromises can look “normal” at install time, yet still plant the ability to authenticate later. Worth noting: neither CloudSEK nor Hudson Rock identified the information source.

Which credentials were exposed, and why does that matter more than “passwords”?

CloudSEK described multiple categories of stolen credentials that go far beyond simple account passwords. The firm said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys. In practice, these are the building blocks attackers use to move laterally: from signing code, to deploying infrastructure, to calling paid AI APIs without triggering friction.
CloudSEK said the harvested credentials could allow attackers to gain access to more than 2,500 organizations. That figure matters because it connects “one breach” to “many victims,” even if only a subset directly interacted with LiteLLM in the relevant window. Attackers don’t need to crack anything if they already hold the keys. That also raises a hard counterpoint: some teams may argue their systems weren’t using LiteLLM “directly,” but supply-chain tools often sit in dependency chains, CI/CD jobs, and automation scripts.

How did the LiteLLM supply-chain compromise work in the first place?

The LiteLLM compromise did not appear in isolation. Ars Technica reported that the incident was the result of a previous supply-chain attack that infected the vulnerability scanner Trivy. In other words, attackers leveraged an earlier foothold, then expanded their reach into additional software components used by developers.
CloudSEK also pointed to other affected software in the wider campaign, including KICS and the Telnyx Python SDK. This is where security posture usually breaks: many organizations focus on “web apps first,” while their developer toolchain becomes a backdoor for cloud, repositories, and orchestration platforms. If your CI pipeline installs compromised dependencies, the damage isn’t limited to a single environment—it extends to every downstream system that trusts those secrets.
That chain-of-compromise logic is the main reason this incident is so dangerous for platforms and enterprises, not just developers. It turns routine automation into an authentication highway for the attacker.

Litellm Credentials Leak:

“Supply-chain attacks don’t need users to click anything; they need build systems to trust the wrong artifact at the right time.”

Stay tuned for more on Terabytes.

Why did investigators need a 195TB file, and what does that imply for detection?

Hudson Rock said it made its discovery after analysing a 195TB file it obtained. Separately, CloudSEK described extracting and identifying credential types in a way that demonstrated broad access potential. Those two details—massive dataset size and multiple credential categories—suggest this was not a one-off theft; it was a systematic harvesting effort targeting secrets embedded in modern software workflows.
A 195TB analysis is a strong indicator that defenders will struggle to “spot check” their way out. Instead, incident response has to be evidence-driven: rotate keys, invalidate tokens, audit repository access, and scan CI logs for suspicious dependency installations. Worth noting: because neither firm identified the source of the information, attribution and “how far it went” may take longer than basic key rotation.
For defenders, this also implies the detection problem isn’t only technical. Teams need fast, consistent secret inventorying so they can tell whether a Kubernetes secret, an SSH key, or an AI provider token was exposed.

Litellm credentials leak: What should organizations do next—rotation, scanning, and dependency hygiene

The immediate operational step is credential containment. Organizations that used LiteLLM during the March window should treat any extracted material—cloud keys, repository tokens, SSH keys, Kubernetes secrets, publishing credentials, environment variables, and AI provider keys—as compromised and rotate them. Because stolen tokens can be used to access integrations long after installation, rotation should include any cached sessions and automation credentials inside CI/CD.
Next, teams should audit dependency provenance and rebuild systems using known-good artifacts from trusted releases. That means rechecking build logs, confirming which LiteLLM versions were installed from the Python Package Index, and validating whether other infected tooling in the same wider campaign (like Trivy, KICS, or the Telnyx Python SDK) appeared in their pipelines. Finally, segmentation matters: reduce the blast radius by ensuring CI systems use short-lived tokens and least-privilege roles.
Here’s the forward-looking part: security teams should tighten artifact verification, including signing and strict dependency allowlists, because the attacker’s win condition was “trust at install time.”

Related Articles

• Tensor Leaked Geekbench:
• Thrift Store Chain
• MacBook Air Supply

FAQs

Which credentials were leaked in the massive supply-chain attack?

CloudSEK said the exposed material included cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys. That mix matters because it supports both infrastructure access and developer workflow compromise. In other words, it’s not just account takeover; it can include deployment permissions and code-signing pathways depending on how each organization configured its toolchain.

Did the breach affect more than one organization?

Yes. CloudSEK said the credentials could enable access to more than 2,500 organizations, based on the stolen secret scope it identified. Hudson Rock’s analysis of a 195TB file reinforced how widely the information could be operationally useful for authentication and pivoting. Even if your organization didn’t publish public repos, the secrets could still be relevant via dependency chains and automation.

How long did the attacker have access during the LiteLLM compromise?

CloudSEK reported that credentials were extracted during a 40-minute window in March while victims used compromised LiteLLM versions downloaded from the Python Package Index location. That short install window can still produce long-term exposure because secrets harvested at install time can be replayed later.

Where were the compromised LiteLLM packages found?

Investigations described victims using compromised LiteLLM versions obtained from the Python Package Index repository location during the relevant period. That detail is important for defenders because it shifts the focus from “malicious websites” to “trusted package channels,” where detection is harder and automation is more common.

What’s the fastest way to reduce risk now?

Rotate credentials immediately—especially any cloud keys, repository tokens, SSH keys, Kubernetes secrets, publishing credentials, environment variables, and AI provider keys tied to affected systems. Then audit build and CI/CD logs for LiteLLM usage during March and verify dependencies against trusted release sources. Finally, tighten artifact verification so future supply-chain compromises can’t pass as “just another update.”
—
If stolen secrets can bypass your perimeter, the only safe next move is fast rotation plus dependency trust controls.