# Terabytes of credentials exposed in massive supply-chain attack

Sensitive data from Microsoft, Amazon, and Cisco compromised in security breach

- **Source:** [Ars Technica - All content](https://brifing.si/source/b728770c-8dda-457a-8986-84879c9fc42c)
- **Published:** 2026-08-12
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/>
- **On Brifing:** https://brifing.si/s/92c7bfa8-8152-41ed-b923-0f103a5fe368

## Large-scale data breach

A supply-chain attack targeting the open-source tool LiteLLM has resulted in the exposure of terabytes worth of credentials belonging to major global corporations. Access keys and sensitive data from tech giants like Microsoft, Amazon, Cisco, Samsung, and Salesforce were compromised. Security firms CloudSEK and Hudson Rock disclosed the breach in announcements made on Tuesday and Wednesday.

## Types of compromised data

The leaked information includes cloud access keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys. CloudSEK's analysis revealed these credentials could potentially allow attackers to access more than 2,500 organizations. The breadth of exposed data highlights the severity of this security incident.

## Attack timeline

The credentials were extracted during a remarkably brief 40-minute window in March. Attackers compromised LiteLLM packages in the Python Package Index repository, tricking users into downloading maliciously updated versions. This precise timing demonstrates the sophisticated nature of the operation, surprising cybersecurity professionals.

## Discovery process

Hudson Rock made the discovery after analyzing a massive 195TB file, though they didn't disclose the file's origin. CloudSEK independently confirmed similar findings while also not identifying the leak's source. The parallel investigations by both firms revealed the extensive scope of the breach.

## Affected organizations

The attack impacted numerous Fortune 500 companies across various sectors including technology, finance, healthcare, and retail. Security experts warn that exposed credentials could lead to secondary attacks through domino effects. The widespread nature of this breach underscores vulnerabilities in global corporate security infrastructures.

## Open-source risks

This incident highlights ongoing security challenges in open-source ecosystems. Despite being distributed through trusted repositories like PyPI, the compromise of popular tools like LiteLLM demonstrates software supply chain fragility. Developers are being urged to implement more rigorous package verification processes.

## Potential consequences

If the stolen credentials fall into malicious hands, experts anticipate a surge in cybercrimes ranging from data theft to financial fraud. Affected companies must immediately rotate access keys and enhance security measures. The cybersecurity community is calling for industry-wide collaboration to prevent similar attacks.

## Industry implications

The breach has reignited discussions about software supply chain security. Cybersecurity professionals are advocating for reevaluating the balance between open-source sustainability and security. The incident also raises concerns about AI tool security, prompting calls for organizations to strengthen defenses against such sophisticated attacks.

## Sources covering this story

- https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._