Mercado Libre source-code and user-data breach

In March 2022, Mercado Libre — the largest e-commerce and fintech company in Latin America, headquartered in Buenos Aires — confirmed that the Lapsus$ extortion group had gained unauthorized access to part of its source code and the personal data of roughly 300,000 of its users.

What happened

The breach came to light as part of Lapsus$'s aggressive early-2022 campaign. The group, which operated primarily through a Telegram channel, posted a public poll inviting its followers to vote on which victim's data it should leak next — listing Mercado Libre alongside other targets such as Vodafone and Impresa.

Mercado Libre responded by filing an 8-K disclosure with the U.S. Securities and Exchange Commission, acknowledging that attackers had obtained access to "a certain portion" of its source code. Lapsus$ separately claimed to have reached 24,000 source-code repositories belonging to both Mercado Libre and its payments arm Mercado Pago.

Crucially, the company stated it found no evidence that its infrastructure systems were compromised, or that any user passwords, account balances, investments, financial information, or credit-card data had been obtained. The exposure was limited to a subset of user records and internal code.

Impact

• Data of approximately 300,000 users was accessed, per the company's initial analysis.
• Lapsus$ claimed access to 24,000 repositories spanning Mercado Libre and Mercado Pago.
• No customer funds, credentials, or payment-card data were reported stolen, and there was no operational downtime to the platform.

The Lapsus$ context

Mercado Libre was one node in a remarkable spree by Lapsus$, a loosely organized extortion crew later attributed largely to teenagers in the UK and Brazil. In the same weeks, the group leaked roughly 190 GB of Samsung source code, dumped data from NVIDIA (including more than 71,000 employee credentials), and breached Microsoft and identity provider Okta. Rather than deploying ransomware, Lapsus$ relied on social engineering, SIM-swapping, insider recruitment, and stolen credentials to reach source-code management systems.

Why it matters

The Mercado Libre breach demonstrated that source-code repositories are now prime extortion targets, valuable both as intellectual property and as a map for finding further vulnerabilities. It also showcased Lapsus$'s theatrical, social-media-driven extortion model, which pressured victims through public polls and leaks rather than private negotiation. For Latin America's flagship technology company, the swift, transparent SEC disclosure — and the fact that segmentation kept payment systems untouched — became a comparative case study in containment, even as the incident underscored how exposed even mature engineering organizations are to credential-based intrusions.