Mercor Lawsuit: Data Breach, Allegations, and Scale AI Claims

Mercor, the AI staffing startup recently valued at $10 billion, is the target of at least seven proposed class action lawsuits tied to a March 2026 data breach, plus a separate trade-secrets suit filed by rival Scale AI in September 2025. The breach cases, filed in federal courts in California and Texas, accuse Mercor of failing to protect contractor and applicant data, secretly surveilling contractors through screenshot software, and violating federal and state privacy laws. Mercor has disputed the claims, and none of the cases has reached class certification or settlement.¹

What Was Exposed in the Breach

The lawsuits describe a March 24, 2026, intrusion in which roughly four terabytes of data belonging to more than 40,000 contractors and applicants was taken from Mercor’s systems.² Plaintiffs’ attorneys have grouped the stolen material into three categories:

Around 211 GB of candidate records, including resumes, contact information, and Social Security numbers.
Roughly 3 TB of video and identity-verification data, including AI interview recordings, passport and driver’s license scans, and facial biometric data.
About 939 GB of technical assets, including Mercor’s platform source code, internal dashboards, and hardcoded API keys.

The complaints allege the stolen data also includes screenshots captured by Mercor’s contractor-monitoring software, meaning personal banking activity, health portal use, and even attorney-client communications visible on contractors’ screens may have been swept up.³ An extortion group posting under the Lapsus$ name later claimed responsibility and put samples up for sale, though security analysts have said its link to the original Lapsus$ collective is unconfirmed.⁴

What Contractors and Applicants Are Alleging

The suits share a common backbone: that Mercor failed to implement reasonable data security for the sensitive personal information it collected, and that it accumulated and shared applicant-vetting data, including background checks, with business partners in violation of the Fair Credit Reporting Act.¹⁵

The most detailed public complaint is Ananthula et al. v. Mercor.io Corporation et al., filed April 21, 2026, by Hausfeld LLP and Hall Attorneys, P.C.⁵ It brings ten causes of action:

Negligence
Breach of implied contract
Intrusion upon seclusion
Violation of the Fair Credit Reporting Act
Violation of the Illinois Biometric Information Privacy Act
Violation of the Illinois Artificial Intelligence Video Interview Act
Violation of the Illinois Consumer Fraud and Deceptive Business Practices Act
Violation of the Florida Deceptive and Unfair Trade Practices Act
Unjust enrichment
Declaratory and injunctive relief

The plaintiffs seek certification of a nationwide class, with subclasses for applicants, workers, and individuals covered by the Illinois biometric and video interview statutes, the FCRA, and Florida consumer protection law.³

A central allegation across the cases involves monitoring software called Insightful, which Mercor required at least some contractors to install on their personal computers. The complaints say the software captured screenshots every 30 to 60 seconds.³ Named plaintiff David Bevvino-Berv, a former Goldman Sachs employee, alleges he was not clearly told the software would capture activity outside his Mercor work, and that it recorded his use of personal bank accounts, health-insurance portals, and roughly 240 other applications.¹ The Texas complaint goes further, alleging the screenshots captured third-party proprietary source code, trade secrets, personal emails, banking and medical information, and attorney-client privileged communications that happened to be visible on contractors’ screens during work sessions.²

The suits also allege Mercor shared recorded candidate interviews with clients to train AI models, contradicting the company’s stated position that recordings are used only internally. The Texas suit specifically alleges interview recordings were shared with external clients. Bevvino-Berv separately alleges he saw financial models and prompts in Mercor’s system that appeared to contain proprietary material from other workers, including “pre-project metadata, hidden defined names, institutional data-terminal markers, real lender or counterparty names,” among other markers of poor data provenance.¹

The Ananthula complaint further alleges Mercor ran captured data through AI-driven scoring systems to build employment-related profiles that users could not meaningfully access, correct, or challenge.⁵ Mercor’s monitoring practices had already drawn a separate suit before the breach: Cox v. Mercor Io Corporation, filed in October 2025, accused the company of installing intrusive monitoring software on workers’ personal computers without reimbursing them for the use of those devices.²

Where the Cases Were Filed

Six of the known breach class actions were filed in the Northern District of California, and one in the Northern District of Texas. Each seeks damages exceeding $5 million and nationwide class certification.⁶

The California cases:

Gill v. Mercor.io Corp., No. 3:26-cv-02831
Deboni v. Mercor.io Corp., No. 3:26-cv-02821
Esson v. Mercor.io Corp., No. 3:26-cv-02839
Lofton v. Mercor.io Corp., No. 3:26-cv-02865
Massman v. Mercor.io Corp., No. 3:26-cv-02990
Ananthula et al. v. Mercor.io Corporation et al., No. 3:26-cv-03362

The Texas case is White et al. v. Mercor Corp. et al., No. 6:26-cv-00143.⁶ The Ananthula complaint also names Delve AI Inc., which had certified the security of the compromised open-source library, and Berrie AI Incorporated, which operates that library, along with ten unnamed “Doe AI Lab” defendants.³

Mercor’s Response

Mercor confirmed the security incident on March 31, 2026 through an internal email, social media posts, and statements to TechCrunch. Spokesperson Heidi Hagberg described Mercor as “one of thousands of companies” affected by the underlying supply-chain compromise and said the company “moved promptly” to contain and remediate the incident with third-party forensics experts.⁷

On the lawsuits, Mercor has said: “We strongly dispute the speculative claims in these lawsuits and look forward to presenting the facts at the appropriate time and place.” The company says it complies with all relevant laws and denies sharing recorded candidate interviews with clients, saying those recordings are used only internally.¹ As of the most recent reporting, Mercor had not reported the breach to state attorney general offices, and no confirmed individual breach notification letters had been sent to affected contractors or applicants.⁸ The company declined to answer questions about whether specific customer or contractor data was accessed, exfiltrated, or misused, or whether the incident is connected to the Lapsus$ group’s claims.⁷

The Separate Scale AI Trade Secrets Suit

The breach class actions are not Mercor’s only pending litigation. On September 3, 2025, rival Scale AI sued Mercor and Eugene Ling, a former Scale AI sales executive, in federal court in San Francisco, alleging Ling took more than 100 confidential documents about Scale’s customer strategies while in communication with Mercor.⁹ Scale alleges the documents would help Mercor win business from one of Scale’s largest customers, identified only as “Customer A,” in a contract worth millions.¹⁰

Mercor co-founder Surya Midha said the company never used any Scale data. According to Midha, Ling had told Mercor he possessed “old documents in a personal Google Drive” that Mercor says it never accessed, and Mercor offered to have Ling destroy the files six days before Scale filed suit. Ling posted on X that he had “no nefarious intent” and had never used the documents in his work at Mercor.¹⁰

Current Status

The breach class actions remain in their early stages as of mid-2026. No court has ruled on class certification, no consolidation has been reported, and no settlements have been reached.⁶ No state attorney general has publicly announced an investigation or enforcement action.⁸ Mercor continues to operate and recently closed funding at a $10 billion valuation.¹¹ If you worked as a Mercor contractor or applied through the platform, the pleaded classes in the filed cases would generally cover you, and the docket entries above are where any certification, notice, or settlement developments will surface first.

1
Wall Street Journal. Mercor AI Startup Personal Data Lawsuit
2
ComplianceHub. Five Lawsuits Mercor Data Breach Litigation Breakdown
3
Hall Attorneys. Mercor Data Breach
4
Wired. Meta Pauses Work With Mercor After Data Breach Puts AI Industry Secrets at Risk
5
Hausfeld. Mercor Data Breach
6
Staffing Industry Analysts. AI Staffing Firm Mercor Faces Lawsuits Over Data Breach
7
TechCrunch. Mercor Says It Was Hit by Cyberattack Tied to Compromise of Open Source LiteLLM Project
8
PR Newswire. Privacy Alert: Mercor.io Corporation Under Investigation for Data Breach of Records
9
Bloomberg. Scale AI Sues Rival Startup Mercor Alleging Trade Secret Theft
10
TechCrunch. Scale AI Is Suing a Former Employee and Rival Mercor Alleging They Tried to Steal Its Biggest Customers
11
Wall Street Journal. The AI Startup Fueling ChatGPT’s Expertise Is Now Valued at $10 Billion