Massive supply-chain attack sees terabytes of data belonging to some of the world’s biggest and most sensitive…

• More than 2,500 organizations, including Cisco, Samsung, AWS, Airbus U.S. Space & Defense, Thales, and the London Stock Exchange Group, have credentials harvested during a supply-chain attack on LiteLLM
• LiteLLM was not directly hacked by the hacking group TeamPCP, which found their way in thanks to a compromised build of an open-source security scanner
• Some of the credentials still work, nearly five months after the original breach, indicating that there is still a persistent security risk until they are changed

Security firms CloudSEK and Hudson Rock have claimed more than 2,500 organizations have had credentials harvested in a supply-chain attack on LiteLLM.

LiteLLM, an open source gateway which translates API calls for over 100 large language models into a single OpenAI-compatible format, was not directly compromised in the attack, as hackers targeted a known vulnerability in Aqua Security's Trivy.

The list included many large and critical service providers, including but...

Copyright of this story solely belongs to techradar.com. To see the full text click HERE