Hacker News: Oravys

New comment by Oravys in "4TB of voice samples just stolen from 40k AI contractors at Mercor"

Oravys — Tue, 28 Apr 2026 08:32:09 +0000

Great point about the helpdesk vector. The LinkedIn-to-IT-reset path is a brilliant illustration of how social engineering chains work. And you're right that audio is the frontier video deepfake detection has gotten really good, lots of great tools out there. Audio is the next wave, and the teams building solutions for real-world call quality are going to unlock a massive market. Exciting space to be in.

New comment by Oravys in "4TB of voice samples just stolen from 40k AI contractors at Mercor"

Oravys — Tue, 28 Apr 2026 08:30:22 +0000

It feels like a dead end because it's being used wrong. "Is this John's voice?" is the wrong question. "Does this call look like how John normally calls?" is way more interesting. Same device, same time of day, same way of starting a sentence. That whole pattern is much harder to fake than a voice alone. The authentication isn't dead, it just needs to grow up from a single check into a full picture.

New comment by Oravys in "4TB of voice samples just stolen from 40k AI contractors at Mercor"

Oravys — Tue, 28 Apr 2026 08:25:49 +0000

Great question. There's no "reverse voice search" yet the way there is for images — that's genuinely a tool the world needs. In the meantime, the most useful thing is searching your name across YouTube and podcast platforms to map out what's already public. And for Mercor contractors specifically, the California AG breach notice gives you a solid legal basis to request full deletion. Worth doing today.

New comment by Oravys in "4TB of voice samples just stolen from 40k AI contractors at Mercor"

Oravys — Mon, 27 Apr 2026 10:02:01 +0000

Author here. Wrote this after watching Lapsus$ post the Mercor archive on their leak site earlier this month. The thing that struck me is the combination: voice samples paired with ID document scans. Most breaches leak one or the other. This one ships a deepfake-ready kit. Tried to keep the writeup practical: what an attacker can actually do with this combo (banking voiceprint bypass, Arup-style video calls, insurance fraud), and a 5-step checklist for the contractors who were in the dump.

  Happy to discuss the forensic detection side. AudioSeal
  watermarks, AASIST anti-spoofing, and how the detection landscape changes
  once voice biometrics start leaking at scale.

4TB of voice samples just stolen from 40k AI contractors at Mercor

Oravys — Mon, 27 Apr 2026 09:57:10 +0000

Article URL: https://app.oravys.com/blog/mercor-breach-2026

Comments URL: https://news.ycombinator.com/item?id=47919630

Points: 559

# Comments: 211