AWS, Cisco, Samsung, and 2,500 other orgs’ secrets leaked in LiteLLM breach fallout

A massive 153GB archive of raw data containing secrets exfiltrated from nearly 2,500 organizations during one of the largest AI supply chain attacks, the March LiteLLM heist, has been obtained by multiple security researchers. The exposed companies reportedly include AWS, Samsung Electronics, Cisco Systems, Salesforce, and many others.

Several security teams “independently obtained” a RAR archive containing a massive trove of stolen corporate credentials. The dump originates from one of the most devastating supply chain attacks: a breach of LiteLLM, a massively popular Python library for AI developers, which caused “software horror” in March.

The list of nearly 2,500 affected organizations includes corporate giants like Amazon Web Services (AWS), Samsung Electronics, Salesforce, Cisco Systems, F. Hoffmann-La Roche, ServiceNow, Siemens, S&P Global, Airbus, John Deere, Deloitte, Orange, and many more, as reported by the threat intelligence companies CloudSEK and HudsonRock.

The data is extremely sensitive and includes AWS secret access keys, Salesforce tokens, Microsoft Azure credentials, AI provider API keys, and other credentials.

Whenever a compromised LiteLLM package was installed or executed, the malware swept live environment memory and configurations, SSH keys, AWS, GCP, and Azure credentials, Kubernetes tokens, .env files, LLM API keys, gateway configuration, etc.

“Our researchers have obtained and analyzed a staggering 153GB RAR archive. This massive corpus contains exactly 433,909 files. Through our analysis, we have successfully attributed 118,829 CI runner dumps to 2,488 affected corporate domains,” Hudson Rock said in its report.

The raw exfiltrated data provides an unfiltered look into the massive scale of the automated attack.

CloudSEK explains that the theft of credentials is not proof that a company was successfully compromised or that the attacker even used the obtained credentials. However, the researchers warn that credentials often remain usable for weeks or even months before being rotated.

TeamPCP, a threat actor responsible for the LiteLLM supply chain attack, and affiliated actors are likely to weaponize stolen credentials long after the initial compromise, the FBI warned in July.

Bot companies offer their tools to check for exposure. CloudSEK’s list selected 2,186 organizations exposed in a breach with high and medium confidence.

Hudson Rock’s “LiteLLM Breach” tool allows browsing affected companies, reviewing censored identities and secret names, and claiming “ethical disclosure.” It appears to combine data from multiple data dumps.

Kevin Beaumont is yet another security researcher who reviewed and confirmed that the data is legitimate, suggesting that the data dump has already widely spread.

At least some credentials are still valid

Beaumont calls this leak “massive” and even estimates that security companies undersell the dataset's contents.

“It's a massive supply chain breach due to poor AI security – not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security. Should be a wake-up call,” Beaumont posted on Mastodon.

The researcher personally tested some of the credentials dating back to March, and despite being assured by one of the impacted organizations that it had rotated all of them, the keys still worked.

“I tried them all. Almost every one worked. Submitted report. One of the biggest US techcos.”

This leaves a massive exposed surface that threat actors can further abuse.

Hugging Rock alerts that all affected organizations should immediately audit their environments and revoke credentials aggressively.

“Assume any secret accessible to your LiteLLM environment is compromised. Invalidate and rotate all AWS/GCP/Azure IAM keys, Kubernetes service account tokens, and GitLab/GitHub PATs,” the company urges.

And that is not enough because attackers might already have gained a foothold. Organizations should audit logs for anomalies, inspect for persistence, and implement strict network egress filtering on runner environments.

“Rotating only the LiteLLM or model-provider key is insufficient. Any credential readable by the affected process, present in process memory, injected into the job, stored on disk, or retrievable through an instance metadata service should be treated as potentially exposed until validated,” CloudSEK’s report reads.

The company is nearly certain that the next supply chain wave will again target AI infrastructure, given its high-value junctions among data, identity, compute, and autonomous action. AI gateways and other tools sit in privileged positions, include many dependencies, lack visibility, operate without human oversight, and have security measures that lag behind.

“Maybe giving all the master passwords to LiteLLM was a bad idea?” one Cybersecurity community member on Reddit concludes.