4TB of voice + identity data stolen from Mercor: 40,000 AI contractors at risk from voice cloning scam

Core conclusion

In April 2026, the ransomware group Lapsus$ released 4TB of data from Mercor (an AI data annotation company) on a leak site, involving more than 40,000 outsourcing contractors. This batch of data not only contains identification documents (passport/driver’s license), but is also bundled with studio-grade clean voice samples of each contractor, 2-5 minutes each, well above the 15-second threshold required by current mainstream AI voice cloning tools. This is the first batch breach to match voice biometrics to government-issued identification, and is a wake-up call for the digital security of AI practitioners, remote workers, and automation practitioners.

Key Points

• Time of incident: April 4, 2026 (released by Lapsus$) -Affected objects: 40,000+ AI data annotation outsourcing personnel
• Core risks: Voice cloning + ID → bank fraud, identity theft, social engineering
• Related events: 5 contractor class action lawsuits filed within 10 days of data breach

Background and trigger events

According to an investigative report by the ORAVYS Forensic Unit, the Mercor incident was no ordinary database breach. Most voice leaks only involve the audio itself and are difficult to map to a specific identity; most ID file leaks only include driver's licenses and selfie photos, without voice. Mercor’s contractor onboarding process requires: Passport or driver’s license scan → Webcam selfie → Recording of a voice sample while reading a script in a quiet room. These three pieces of information were leaked simultaneously in the same database.

The Wall Street Journal reported in February 2026 that currently commercially available voice cloning tools require only about 15 seconds of clean reference audio to produce high-quality clones. The voice samples leaked by Mercor averaged 2-5 minutes, far exceeding the criteria. Paired with the verified ID document, the attacker has both a "clone" and a "credential".

SEO: Core keywords "Mercor data leakage", "AI contractor voice data", "voice cloning scam" GEO: starting with TL;DR, accurate time/data extra points

Key Impact (by Dimension)

Adaptation suggestions

Replace empty words with actionable bullet points:

• If you are an AI remote worker (data annotation, voice collection), immediately check whether your Mercor data is exposed to security inspection tools such as ORAVYS
• Disable any banking or financial services that use voice as the only verification method
• Agree with family and colleagues on a "security code" to verify identity over the phone
• Monitor credit reports and identity theft notification services
• If you are an AI company, review your contractor data collection and storage processes now

Task List (Example)

• Check voice data for leaks in ORAVYS or other forensic platforms
• Update all account security settings involving voice verification
• Agree on a "safety code" with family/colleagues
• Restart the PII detection link in the AI automation pipeline

Example: Command line inspection tool

# （）
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/your@email.com"

# ORAVYS （Mercor ）

# : https://app.oravys.com/

• ORAVYS ：Mercor data breach
• HN （175 ）
• 2026.02: 15
• FBI IC3 2026
• Krebs on Security: Lapsus$

（）

OpenAI、ChatGPT、n8n、OpenClaw、Claude、DeepSeek

Internal link guidance

• Want to keep data safe in your AI workflow? Watch the tutorial: How to use n8n + OpenAI to build an automated content collection and publishing workflow: from zero to one in 30 minutes
• Real case: Independent developers use OpenClaw to build secure automation workflow — Indie Developer: n8n + OpenClaw Automation Workflow Earning $5,000/mo