A 40-Minute Attack Exposed Credentials from Microsoft, Amazon, Cisco and 2,500 Other Organisations

Key points

• A supply-chain attack on LiteLLM, an open-source tool that helps developers build AI software, exposed credentials belonging to more than 2,500 organisations.
• The theft happened in a 40-minute window in March 2025 when victims downloaded a compromised version of LiteLLM from the official Python Package Index, the standard online library for Python software.
• Security firms CloudSEK and Hudson Rock disclosed the breach on Tuesday and Wednesday; Hudson Rock found the stolen data inside a 195 TB (terabyte) file.
• Named organisations whose access secrets were exposed include Microsoft, Amazon, Cisco, Samsung and Salesforce.
• The stolen material includes cloud keys, SSH keys (digital passwords for servers), and Kubernetes secrets (credentials that control cloud computing clusters), among other sensitive items.

A software tool used by thousands of developers to build AI applications was quietly tampered with in March, and the window of theft lasted just 40 minutes. That was long enough.

Security firms CloudSEK and Hudson Rock, first reported by Ars Technica AI, published findings on Tuesday and Wednesday showing that attackers had slipped a malicious version of LiteLLM into the Python Package Index, the central online library where developers download ready-made software components. LiteLLM is an open-source tool that acts as a common layer between AI models and the applications built on top of them, letting developers swap between different AI providers without rewriting their code.

What exactly was stolen?

A lot. CloudSEK says the compromised versions harvested cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and API keys for AI providers. All of those are the digital equivalents of master keys: whoever holds them can walk into systems, read data, send commands, and in some cases publish software updates on behalf of the victims.

The firms named Microsoft, Amazon, Cisco, Samsung and Salesforce as just a few of the affected organisations. CloudSEK counts more than 2,500 in total.

Hudson Rock made its discovery after analysing a 195 TB file it obtained independently. Neither firm has named the attacker or identified the precise source of that file.

Should ordinary developers and companies be worried?

Yes, if they use LiteLLM and downloaded an update in March without checking its integrity. The attack is a textbook supply-chain compromise: rather than hacking each target directly, the attacker poisoned a shared tool and let the victims come to them.

For end users of products built on LiteLLM, the risk is indirect but real. A stolen cloud key can expose customer data stored in that cloud account.

Any organisation that uses LiteLLM should audit which version it is running, rotate (replace) any credentials that could have been in use during March, and check access logs for unusual activity.

What happens next?

Neither security firm has confirmed that affected companies have been individually notified. The Python Package Index maintainers have not yet issued a public statement about the compromised package.

This incident follows a pattern that security researchers have warned about for years: open-source tooling used in AI development carries the same supply-chain risks as any other software, and the rapid growth of AI adoption means the blast radius when something goes wrong keeps getting larger.

Common questions

What is a supply-chain attack?

Instead of breaking into a company directly, attackers tamper with a tool or software component that the company downloads and trusts. The victims infect themselves without knowing it.

How do I know if my organisation was affected?

Check your LiteLLM version history for any updates applied in March 2025, then rotate all credentials that application could have accessed. Your security or IT team can pull download logs to confirm which version was in use.