Mercor Data Breach Class Action

What we know about the Mercor data breach

In late March 2026, attackers published compromised versions of LiteLLM, a widely used open-source software tool, designed to steal credentials from any system that installed them. Mercor has confirmed it was among the companies affected, and says it contained the activity, completed a forensic investigation, and began notifying affected individuals directly on June 25 and 26, 2026, along with an offer of TransUnion identity protection services.

A cybercriminal group claimed responsibility for the attack and said it held approximately four terabytes of Mercor’s data, including a database of more than 200 GB and roughly three terabytes of video and verification files, according to U.S. court filings reported by Staffing Industry Analysts. At least seven proposed class actions have since been filed in U.S. federal courts.

For its part, Mercor has said its investigation found that only a limited subset of the people registered on its platform had sensitive information affected, and that it has seen no evidence the data has been used fraudulently to date. What that means for individual applicants and workers, including those in Canada, is exactly what a class proceeding is designed to test.

Who may qualify for a proposed class action

You may be part of the proposed class if you live in Canada and you:

• applied for work through Mercor at any time;
• worked as a contractor or completed projects through the platform;
• completed an AI video interview, identity verification, or background check as part of Mercor’s process; or
• installed monitoring software on a personal device in connection with Mercor work.

You do not need to have received a notification letter to register. If you are not sure whether your information was involved, register anyway, our class actions team can help you find out where you stand.