# Stolen LiteLLM Credentials Leak Exposes 500,000 Credentials

> Hackers stole 500,000 credentials from 2,488 organizations via LiteLLM supply chain attack.
- Title: Stolen LiteLLM Credentials Leak Exposes 500,000 Credentials
- Summary: Hackers stole 500,000 credentials from 2,488 organizations via LiteLLM supply chain attack. TeamPCP hackers compromised LiteLLM's PyPI keys in March 2026…
- Keywords: litellm, trivy, teampcp, pypi, credentials, supply chain attack, openai, github, nvidia, aws, samsung, siemens
- Source: Startup Fortune — https://startupfortune.com/stolen-litellm-credentials-from-march-hack-surface-in-153gb-leak
- Published: 2026-10-21T17:31:16+00:00
- Read time: 1 min
- Topics: litellm, trivy, teampcp, pypi, credentials, supply chain attack, openai, github, nvidia, aws, samsung, siemens
## Initial Breach Chain
TeamPCP exploited Trivy's incomplete credential rotation on March 19, 2026.
## Cascading Attacks
Attackers pushed malicious commits to 76 of 77 trivy-action tags and all seven setup-trivy tags.
## LiteLLM Compromise
TeamPCP deployed trojanized LiteLLM versions 1.82.7 and 1.82.8 on March 24, 2026.
## Credential Harvesting
The payload harvested environment variables, SSH keys, Kubernetes secrets, and AI provider API keys.
## Stolen Credentials
CloudSEK recovered 433,909 files from 2,488 organizations including Nvidia, AWS, Cisco, Samsung, and Siemens.
## Five-Month Validity
Five months after the breach, 500,000 credentials remained valid with no rotation.
## FBI Advisory
A July 2026 advisory warned attackers would keep weaponizing stolen credentials.
## Key takeaway

TeamPCP hackers compromised LiteLLM's PyPI keys in March 2026, stealing credentials from 500,000 organizations that remain valid five months later.