The security firm Hudson Rock has evaluated and released an archive of stolen credentials from the LiteLLM attack of March 2026. The 153-gigabyte collection contains 433,909 files, which analysts attribute to 2,488 company domains – far more detail than the earlier estimate from the start of August.
Archive bundles raw data from tens of thousands of pipelines
According to Hudson Rock co-founder Alon Gal, the data comes from automated CI runner environments that were skimmed in March by the injected file litellm_init.pth. Of the 433,909 files in the archive, the firm attributes 118,829 CI runner dumps to specific company domains, while the rest still lack a clear match. The package bundles AWS access keys, Azure environment variables, Slack signing secrets, Salesforce client secrets, internal JWT tokens, database passwords, and API keys for AI providers. Also found were local configuration files such as .aws/credentials and .kube/config, plus GitLab credentials pointing to direct access to developer machines.
The original attack itself is not new: as beckmann.ai already reported, the group TeamPCP compromised the scanner Trivy in March and used it to publish two tampered LiteLLM versions on PyPI. What’s new is the scale of the raw data now under review: where the CloudSEK report from August 11 relied on matched domain lists, Hudson Rock is now publishing the underlying 153-gigabyte archive itself for scrutiny and feeding it into its own threat database, Cavalier. For comparison: the data volume is roughly equivalent to 30,000 high-resolution photos – bundled here as plain text and configuration files pulled from corporate systems.
More big-name companies now appear on the list
Beyond the six names already known from the CloudSEK report – Nvidia, Amazon Web Services, Cisco, Salesforce, Orange, and Siemens – Hudson Rock now also names Samsung, ServiceNow, S&P Global, Deloitte, John Deere, Epic Games, and British telecom group BT Group as organizations with hits in the archive. The remaining roughly 300,000 files could not yet be clearly matched to a domain, meaning the number of actually affected organizations could still grow.
Notable is the share of manufacturing and agricultural-equipment suppliers such as John Deere alongside financial firms like S&P Global and consultancies like Deloitte – industries where stolen cloud access can cause especially large follow-on damage. Consultancies in particular often hold access to their own clients’ systems, so a single compromised account can indirectly affect other organizations too.
This attribution is independently unverified: it rests on Hudson Rock’s own matching of metadata found in the dumps against known company domains, and none of the named companies has confirmed it. Security researcher Kevin Beaumont attributes the find to weak DevOps security at the affected organizations.
Affected companies can review their own data
Hudson Rock offers a free lookup at hudsonrock.com/litellm: companies enter their domain and find out whether credentials from their organization turn up in the archive. Anyone who confirms a match gains insight into their own findings through Cavalier, the platform the firm otherwise uses for its own threat analysis, as part of a global disclosure program.
Gal describes the approach as an attempt to reach affected parties directly rather than letting the raw data circulate unchecked. Hudson Rock says it regularly uses a similar process for findings from infostealer campaigns to warn companies about criminal access to their credentials.
The FBI had already warned in a flash alert in July that credentials copied in March can keep being abused in new attacks regardless of the affected software’s current status. For security teams, that means uninstalling a package does not end the risk as long as the keys copied back then have not been actively rotated. Not finding your own domain on the list is therefore no guarantee of safety either – the 2,488 matched domains represent only the portion of the archive identified so far.
What matters now is how many of the newly named corporations actually use the lookup and rotate their keys before criminals turn the credentials that have circulated for five months into new attacks. CrowdStrike recently described a similar pattern involving stolen AI access via hijacked npm packages – stolen credentials for AI services, it turns out, remain a lucrative target months after their discovery.
