Data Buyer Incidents: Breaches, Complaints and Disputes, Dated and Sourced

A data buyer incident, in this register, is a dated public record of a security breach, a regulator complaint, a court-appointed reviewer's finding or a lawsuit that names a company buying or collecting data for AI training. The register holds 12 such records naming six companies, each with its docket or notice and a status as of 2026-11-09. Mercor reported a breach to a state regulator, a court-appointed privacy reviewer questioned two prospective buyers in a bankruptcy data sale, and only one of the six contributor claims, McKinney v. Scale AI, carries a court-approved amount, a gross USD 12,500,000 with final approval filed on 2026-10-30.

The register belongs to an independent reference on AI training data licensing that takes no cut of any sale. Allegations stay allegations, and incidents are listed whether or not a buyer runs a referral program.

Every date, docket and notice below was read from the primary record; see how DataPacts sources and dates every figure.

What Counts as an Incident in This Register

A record enters the register only when a primary source documents it: a court docket entry, a regulator's notice or filing, or the company's own statement. Four record types qualify:

• security incidents reported to a regulator;
• complaints filed with data protection authorities;
• findings or questions of a court-appointed reviewer in a data sale;
• lawsuits by contributors, or by holders whose data was collected.

Forum posts, review scores, press-only reports and attacker claims stay out, because none of them can be tied to a docket or a company statement. A status changes only when a newly read docket entry changes it, and each row keeps the date on which it was read. The register is not a ranking and does not score companies: a company with several rows is not thereby worse than one with none, because a row exists only where a record was filed, and some records are lawsuits that name a company as employer rather than as a data buyer.

The Incident Register, Dated

The table lists 12 records in order of their first dated event, with the forum, the docket or notice, and the status read on 2026-11-09.

"Status" is the latest docket entry read, never an inference, and "allegations" marks claims that no court has decided. A company named in several rows is linked once.

Security Incidents Reported to a Regulator

Mercor.io Corporation reported to the California Attorney General on 2026-06-25 that unauthorized access through compromised versions of the open-source LiteLLM library occurred on 2026-03-24 and 2026-03-30. Mercor sent notices to affected experts on 2026-06-25 and 2026-06-26.

Mercor states that "a very limited subset" of its "nearly five million" experts had sensitive information affected. The notice offered 24 months of TransUnion credit monitoring, with enrollment open until 2026-10-01, a date that has passed.

The suits over the incident are consolidated as In re Mercor.io Corporation Data Breach Litigation (N.D. Cal. Lead Case No. 3:26-cv-02821-WHO), consolidated on 2026-05-19. The parties stipulated a stay pending mediation on 2026-07-21 (Dkt. 44), and no court has ruled on the merits as of 2026-11-09. The people affected were contributors, who gave the company their own details and work product, and what the incident meant for them is covered under contributor privacy on human data platforms. No breach involving company data licensed to Mercor appears in the record read.

Complaints Filed With Data Protection Authorities

noyb states that it filed five GDPR complaints against Scale AI over its Outlier platform on 2026-10-27, together with Intérêt à Agir, DIPLab and Reversing.Works, before authorities in France, Italy, the Netherlands and Austria.

The complaints allege trackers on workers' devices, Persona biometric checks and unanswered access requests. noyb states that Outlier has more than 900,000 workers. No authority has published a reference number or a decision as of 2026-11-09, and the complaints concern contributor data, not data licensed by companies.

Court-Appointed Privacy Review of Bidders in a Data Sale

In the Spirit Airlines bankruptcy, the court-appointed Consumer Privacy Ombudsman's Supplemental Report (Bankr. S.D.N.Y. No. 25-11897 (SHL), Dkt. 1684, filed 2026-10-05) asked for further research into Mercor's security incident and into whether Mercor.io Corporation is an appropriate, qualified buyer if the court considers it as successful bidder.

The notice of auction results (Dkt. 1463, 2026-08-14) names Google LLC as successful bidder at USD 10,000,000 and Mercor.io Corporation as alternate bidder at USD 7,500,000, and the sale is not approved as of 2026-11-09. micro1 filed a Notice of Intent to submit a competing bid (ECF No. 1556, 2026-09-03), with no amount stated. The same report notes that micro1 proposed to de-identify the data itself rather than use an independent party, and requests a chance to review. Why a court appoints a consumer privacy ombudsman is set out elsewhere: under 11 U.S.C. § 363(b)(1), personal data may be sold against a restrictive privacy policy only after an ombudsman is appointed under 11 U.S.C. § 332.

For the existing sale, the report finds that approval "would be appropriate" from a privacy perspective after passenger databases were excluded and Tonic.ai was hired as Deidentification Agent. The hearing is adjourned to 2026-11-17 (Dkt. 1779), and no order approving the sale exists as of 2026-11-09.

Access Disputes Naming a Buyer and Data-Collection Services

Reddit, Inc. sued SerpApi LLC, Oxylabs UAB, AWMProxy and Perplexity AI, Inc. in the Southern District of New York on 2025-10-22 (No. 1:25-cv-08736-PAE), alleging circumvention of access protections to collect Reddit content from Google search results.

Reddit alleges that almost three billion search result pages were accessed. On 2026-07-31 (Dkt. 104) the court predominantly denied the motions to dismiss of SerpApi and Perplexity, and the Oxylabs motion was briefed with no decision as of 2026-11-06. The case concerns how data was collected, not a license, so it matters to a holder whose content is collected rather than to a licensor choosing a buyer.

Claims by Contributors Against Companies That Buy Data

Six of the 12 records are claims by contributors, the people paid to produce human data, against Scale AI, Surge Labs, Handshake AI and Mercor, and only McKinney v. Scale AI has ended in a court-approved amount: a gross USD 12,500,000, final approval filed 2026-10-30, with payments reported on Form 1099. The others are pending (Cavalier, White), stayed pending mediation (Boggs), voluntarily dismissed (Schuster) or noticed as settled with terms not public (Ramey), and none concerns the terms on which these companies license company data. Pay, classification and platform conduct are set out by platform under AI training jobs and platforms.

Benefits, Risks, Downsides and Alternatives When a Buyer Has an Incident Record

Checking a buyer's incident record before licensing shows how the company has handled data and disputes so far, but a short or empty record is not a clean bill of health.

Benefits

• Records are dated and sourced, so each can be put to the buyer in diligence.
• Court-supervised sales show which questions a privacy reviewer asks of bidders.

Risks

• Data in a buyer's systems is exposed to the buyer's own security failures.
• A buyer's dispute can delay or condition a deal it is part of, as the Spirit review shows.
• Data later found unlawfully obtained can lead to deletion of models and algorithms: FTC Office of Technology staff wrote on 2024-01-09 that the FTC has required this in prior enforcement actions.

Notice terms differ by instrument. micro1's Data License Master Terms require notice of a security incident within 2 business days after becoming aware (checked 2026-11-09), a non-binding model term in Annex V of Commission Recommendation (EU) 2026/2394 uses 24 hours of discovery, and a GDPR controller notifies its authority within 72 hours where feasible (Art. 33(1)). Notice, deletion and audit clauses of an AI data licensing agreement decide which of these a licensor can rely on.

Downsides

• The register shows only what reached a court, regulator or the company's own statement, so most buyers have no row.
• Open cases change, and a status is only as current as its check date, so a reader should open the linked docket before relying on a row.

Alternatives

• License to a buyer with no recorded incident, after the holder's own diligence.
• License through contract terms that set notice, deletion and audit rights.
• Do not license at all and keep the data.

Where the Incident Register Sits Among Buyer Pages and Seller Checks

The register is the cross-buyer view of records that each buyer profile summarizes for one company. It extends the directory of who buys AI training data, and several of the companies here run company data partnership programs compared on their own page. A row is one input to choosing a buyer for your data, not a ranking.

1. Put each row to the buyer during due diligence in an AI data deal.
2. Set access and encryption rules for security during an AI data sale.
3. Case narratives sit with contributor lawsuits against human data platforms.
4. Compare alternatives to selling data, including keeping it.

More About Data Buyer Incidents

What the Register Does Not List

Four kinds of record stay out of the register because another page owns them or because they are not incidents.

• Copyright suits over training data against labs are tracked with other AI copyright lawsuits over training data.
• Crawler conduct, for example Cloudflare's statement of 2025-08-04 that Perplexity used undeclared crawlers at 3 to 6 million requests a day, is covered under AI crawlers and how to block or charge them.
• Insolvency filings of data licensors, for example Getty Images Holdings, Inc.'s prepackaged chapter 11 (Bankr. D. Del. No. 26-11643 (JKS), filed 2026-10-21), are covered under data assets in insolvency.
• Gaps in a buyer's own terms, for example Alpheva AI's terms labeled provisional and HUMXN's terms with unfilled placeholders (both checked 2026-11-09), stay on the buyer's profile.

This page is information, not legal advice.

Frequently Asked Questions About Data Buyer Incidents

Has a company that buys AI training data had a data breach?

Yes. Mercor reported to the California Attorney General that unauthorized access through compromised LiteLLM versions occurred on 2026-03-24 and 2026-03-30; the resulting suits are consolidated and stayed pending mediation as of 2026-11-09.

Is a lawsuit against a data buyer proof of wrongdoing?

No. A complaint states allegations; only a ruling or an approved settlement resolves them. Of the six contributor records here, one has a court-approved amount.

Does a data buyer have to tell a licensor about a security incident?

The license contract sets that duty in the instruments read here. micro1's master terms set 2 business days after it becomes aware, checked 2026-11-09, and GDPR Art. 33(1) separately requires notice to the authority within 72 hours where feasible.

Why are online reviews and forum complaints not in the register?

They cannot be tied to a docket, a regulator's file or the company's own statement. They therefore cannot be dated and checked the way each row is.

Or follow deal tracker updates by email.