Connect with us

Tech

After data breach, $10B-valued startup Mercor is having a month

Six months ago, Mercor was flying high after raising a massive $350 million Series C that valued the AI data training startup at $10 billion. But after admitting on March 31 that it was the target of a data breach, the company has been facing a world of trouble.

Since then, a hacker group has claimed to have obtained 4TB of stolen data from Mercor’s systems, including candidate profiles, personally identifiable information, employer data, source code, and API keys. Mercor has not commented on the authenticity of the data, reiterating only that it is investigating and “will continue to communicate with our customers and contractors directly as appropriate and devote the resources necessary to resolving the matter as soon as possible.”

Mercor said its data breach was the result of a hack of the open source tool LiteLLM. This tool is so popular that it’s downloaded millions of times a day. For 40 minutes, the tool harbored credential harvesting malware — rogue software that could steal login credentials. Those credentials were used to gain access to more software and accounts, which it used to harvest more credentials, and so on.

While there have been no formal acknowledgments of how much data was scooped up from Mercor, there have been repercussions all the same. Meta has paused its contracts with Mercor indefinitely, sources told Wired. (Mercor declined to comment to TechCrunch about this.)

Like other contract AI data training companies, Mercor handles some of the model makers’ biggest trade secrets: the custom data sets and processes they use to teach their models. This is so important to them that even after Meta spent $14.3 billion on Mercor’s competitor Scale AI, it continued working with Mercor.

In a spot of good news for Mercor (maybe…we’ll see): OpenAI also confirmed to Wired that it was investigating its exposure in Mercor’s breach, but said it had not paused or ended its contracts at the time. However, TechCrunch has heard from multiple sources that other large model makers may also be weighing their relationships with Mercor after the breach, although we have not confirmed enough details to name names as of yet.

In the meantime, five of Mercor’s contractors have filed lawsuits, Business Insider reports, over their alleged personal data exposure. Whether these suits represent a serious threat or are just opportunistic and a nuisance remains to be seen. (Mercor declined to comment.)

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

One lawsuit, reviewed by TechCrunch, even named LiteLLM and Delve as defendants. This is wild, and perhaps a stretch, but here’s the connection: LiteLLM used AI compliance startup Delve to obtain its security certifications. Delve has been accused by an anonymous whistleblower of allegedly faking data for security certifications and using rubber-stamping auditors.

A security certification does not directly prevent hackers from launching successful attacks, but it is intended to ensure that companies have processes in place to minimize such threats.

Although Delve has denied those allegations while simultaneously instituting operational changes, it has been in a world of hurt of its own, to the point where Y Combinator severed ties with the company.

LiteLLM ditched Delve and is now working with another AI compliance startup to obtain its security certifications again. LiteLLM also published a complete report on the security incident.

But Mercor itself was not a Delve customer, the company confirmed to TechCrunch. If, however, the fallout for Mercor continues, a lot of revenue could be at stake. The company was reportedly on pace to hit over $1 billion in annualized revenue earlier this year before the data leak, an anonymous source told The Information.

source

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Hacker stole £700,000 from UK energy company by redirecting payment

British oil and gas company Zephyr Energy says someone stole £700,000 (close to $1 million) from one of its U.S.-based subsidiaries by redirecting a payment meant for a contractor into a hacker-controlled account.

In a regulatory filing with the London Stock Exchange on Thursday, the company said it is “working with the corresponding banks and consultants to attempt to recover the diverted funds.”

While the company did not say how the incident occurred, hackers are known to break into email inboxes or accounting systems and use that access to alter bank account and routing numbers during the process of paying someone or clearing an invoice. Known as business email compromise attacks, the FBI said in its most recent annual report published on internet cybercrime earlier in April that these attacks remain one of the top sources of financial losses, totaling more than $3 billion in victim losses during 2025.

Zephyr says that its incident is contained and that its operations are running normally.

As for the attack itself, the company said it used “industry standard practices” for its tech and payment platforms, but said it has implemented “additional layers of security” following the incident.

A spokesperson for Zephyr did not return an email requesting comment about the incident.

(via The Register)

source

Continue Reading

Tech

X brings back Voice Notes to X Chat

Posting Voice Notes publicly on X may no longer be possible, but you can now share audio messages within X’s direct messaging system, X Chat, once again. The social network announced late on Wednesday that support for Voice Notes is now available within its private messaging service.

The feature, which works in both one-on-one messages and group chats, is activated with a push of the voice input icon to the right of the chat’s text box. At launch, you have to continue to press the button to record the voice message, but we found that a press-and-hold gesture followed by a swipe up allows it to record without having to keep your finger on the button.

The new addition could make X Chat more competitive with other messaging apps, where recording audio voice notes has long been a standard option. This is particularly important to the company, given the recent spinout of X Chat as its own stand-alone app.

It could also assuage angry users who didn’t appreciate that the upgrade to X Chat removed the Voice Notes feature.

The move follows X’s recent beta tests of an X Chat app on iOS, which offers access to X’s upgraded DM feature. While the company claims that chats are end-to-end encrypted, security experts have warned that the service is less secure than other encrypted messaging apps, like Signal.

The introduction of the new app reflects a strategy change for the social network, as owner Elon Musk once said X would become an all-in-one super app, or “everything app.” Now, the company is looking to make pieces of its app available as their own experiences. X Money, X’s payments service, is also being tested as a separate app, for instance.

Voice Notes have been on X Chat’s roadmap for some time despite their temporary removal. When X first introduced its new chat platform in November, it said the audio feature would be “returning soon.”

Currently, the X Chat service also supports other features, like the ability to edit and delete messages, block or get notified of screenshots, share files, make voice and video calls, and set messages to automatically disappear.

source

Continue Reading

Tech

Avec’s Tinder-style email app allows you to swipe through your inbox

Apps like Superhuman and Mimestream have tried to get people to inbox zero on the desktop. Now a new app called Avec for mobile devices, initially available on iOS, aims to get you through your inbox using Tinder-style swipe cards and voice-based replies.

By default, the left swipe adds the email to a pile that you can address later, and the right swipe adds it to the done (or archive) pile.

The email “stack” of cards also has a button at the bottom that lets you hold it to reply to emails using your voice. When you release the button after speaking, the transcription will show up as a draft. You can review the transcription for errors, make any necessary edits, and then send the email.

Avec said that while apps like Wispr Flow, Willow, and Monologue exist, they are constrained by Apple’s APIs, and users need to install them as a separate keyboard app to work. Meanwhile, Avec has the full context of your email, so it can understand names and apply better edits based on the tone of the email. Because of this context, the email app can understand your personal email style as well, the company said.

Image Credits:Avec (screenshot)

While managing your inbox, Avec lets you mark unimportant emails by swiping down. The email will learn from what’s put in the unimportant pile and can show it to you in a group instead of forcing you to triage these emails one by one.

While the card-based interface is Avec’s unique feature, it also offers a plain old list-based view.

The app was founded by Jonathan Unikowski, who previously worked at Replit in a product engineering role. Unikowski said he was thinking about building tools that he would use every day. He explored ideas like building a browser but eventually ended up with email.

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

“It’s this thing that hasn’t changed for 25 years,” Unikowski told TechCrunch over a call. He said Gmail was the last big change in email, which has had long-term impacts on how email is managed. “It’s a big part of everyone’s life, no matter how much they hate it. And it seemed very clear to me that through a combination of really good design and, of course, the judicious use of these new AI tools, we could do much better.”

Image Credits:Avec

Avec is not alone in having this thought process. Apart from Superhuman, apps like Shortwave and Spike have tried different approaches to presenting email. In the last decade, Basecamp’s Hey has tried to “reinvent” email by becoming a new provider, but, as a paid service, it hasn’t reached the same scale as Gmail.

When I asked Unikowski about choosing mobile over desktop as a first place to launch an email client, he said that constraints on the platform can force creativity, and the phone is usually the place where people look at their emails.

“I really am a firm believer in this idea that constraints force creativity, and so you get away with a lot less on an iOS app. On phones, you have a very small screen [as compared to the desktop]. You don’t have a physical keyboard. So if you’re going to convince someone to install a new app, it needs to be really good. And for it to be really good, you need to be extremely inventive,” he said.

The app is currently available in the U.S. and is free to use for Gmail users. Support for Outlook is in the works. Unikowski said that the company plans to introduce paid tiers at some point, but it is still ideating about what features to include within that premium offering.

The company has raised $8.4 million in funding to date from investors, including Lightspeed and Haystack, with participation from individuals such as Replit CEO Amjad Masad, Replit’s head of AI Michele Catasta, Behance co-founder Scott Belsky, and Lenny Rachitsky.

source

Continue Reading