CloudSEK says more than 2,500 organisations may have been exposed in LiteLLM incident
CloudSEK says a March 2026 compromise of LiteLLM may have exposed more than 2,500 organisations and about 434,000 CI/CD pipelines.
CloudSEK said on Aug. 12 that it identified more than 2,500 organisations that may have been affected by a March 2026 supply-chain incident involving LiteLLM, an open-source tool used to connect applications with artificial intelligence models.
The company said about 434,000 automated software-development pipelines, or CI/CD pipelines, were linked to the exposure. It said the affected organisations span technology, cybersecurity, banking and financial services, telecommunications, manufacturing, consulting, logistics and enterprise software.
CloudSEK said exposed material could have included cloud credentials, source-code access, server keys, software-development secrets and AI API keys. It also said that appearing in the dataset does not automatically mean an organisation was breached or that data was stolen.
CloudSEK said its exposure dataset includes high-confidence matches tied to organisations such as NVIDIA, Samsung Electronics, Cisco Systems, Siemens, S&P Global, ServiceNow, Deloitte, Vodafone, X Corp, Zscaler, FedEx, Volkswagen, Thales and London Stock Exchange Group. The company did not say those organisations were breached.
According to the release, the incident happened after cybercriminal group Team PCP compromised LiteLLM in March 2026. CloudSEK said malicious versions of the package were reportedly available through the Python Package Index, or PyPI, for about 40 minutes.
CloudSEK said removing the malicious package does not automatically invalidate any credentials that may have been copied. It said risk can continue until credentials are rotated or revoked.
The company said possible consequences could include data breaches, intellectual-property theft, operational disruption, financial losses, regulatory scrutiny and reputational damage. It also said the FBI issued FLASH-20260702-01 on July 2, 2026, covering TeamPCP.
CloudSEK said it has made its exposure research public and released a free tool for checking exposure. The release also points readers to a full list of potentially affected organisations.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.