Intake open
Mercor data breach claims, what happened and who can sign up
Last checked August 30, 2026
Mercor contractors whose personal data was exposed in a March 2026 supply-chain attack can sign up for individual arbitration claims. This is a law-firm intake run by ClaimsHero, not a settled class action, and no court has approved any fund.
Mercor disclosed in March 2026 that it was hit through the LiteLLM open-source library. The incident allegedly exposed about 4 terabytes of contractor data, including Social Security numbers, government IDs, payment details, facial biometric data, voice recordings, and AI video interview footage. The hacking group LAPSUS$ has reportedly claimed responsibility and is allegedly auctioning the data.
What the claims allege
The claims say Mercor failed to protect the identity documents and recorded interviews it collected from people who applied to or worked on its platform, and that a compromised dependency gave attackers a path into that data.
Each person's claim is brought individually through JAMS arbitration, with no class action. In practice that means a firm evaluates your facts on their own, and any resolution depends on your evidence, the applicable law, and whatever is reached through arbitration or settlement.
Who the intake is looking for
- You interviewed or contracted for Mercor, for example by signing a Mercor Worker Agreement or submitting a W-9.
- You uploaded a passport, driver's license, or government ID for verification, or completed a recorded AI video interview, assessment, or onboarding call.
- You received a data breach notification email from Mercor. The intake asks you to share it to confirm eligibility.
Where things stand
The listing is marked limited availability, which means the intake is open now but the firm controls how many people it takes on and can close sign-ups at any time. No filing deadline has been published. Nothing has been paid to anyone at this stage.
After you submit the sign-up form
ClaimsHero, which is licensed in Arizona and partners with law firms in other states, reviews what you send. Submitting the form does not create an attorney-client relationship. If a firm decides to take your claim, you receive a separate representation agreement, and only signing that makes them your lawyer.
The intake is free to complete. Payout lists this claim as a free discovery service and does not take any part of a recovery, and it cannot tell you whether a firm accepts your claim or what an arbitrator decides.
Questions about the Mercor Data Breach case
Is the Mercor data breach claim a class action?
No. Claims are filed as individual arbitration cases through JAMS, and a law firm reviews each person separately.
What do I need to sign up?
The intake asks for your Mercor breach notification email and confirmation that you gave Mercor an ID document or completed a recorded interview or onboarding call.
Does submitting the form mean I have a lawyer?
No. A firm has to review your submission and send you a separate agreement, and representation begins only when that agreement is signed.
Is there a deadline for the Mercor claim?
No deadline has been published. The intake is listed as limited availability, so the firm can stop accepting sign-ups without notice.
There are more like this open right now
Payout tracks the whole docket and files the settled ones you qualify for. Free.