Mercor just lost 40,000 voices. You can't change yours.

On April 4, 2026, Lapsus$ posted Mercor to its leak site. The dump: roughly four terabytes of voice recordings paired with government-issued ID documents from over 40,000 contractors who signed up to label data and record reading passages for AI training. Five lawsuits were filed within ten days. Plaintiffs argue the company collected voice prints under a "training data" framing without making clear these were permanent biometric identifiers. Lawsuits matter, but people whose voices are already out there have a more immediate problem.

Most voice leaks fall into one bucket or another. Call center recordings with no easy identity mapping, or ID document leaks with no audio attached. **Mercor** merged both columns. Their onboarding pipeline asked for a passport or driver's license, a webcam selfie, then a studio-quality voice recording of scripted prompts. According to the Wall Street Journal, voice cloning now requires roughly 15 seconds of clean reference audio. These recordings average two to five minutes per contractor. Pair that with a verified ID document and an attacker has both the clone and the credential to put it to work.

Banks still treat voiceprint matching as a verification factor. Pindrop reported a 475% year-over-year increase in synthetic voice attacks against insurance call centers in 2025. Consider the 2024 Arup deepfake video call fraud: $25 million lost, built from public footage. Mercor's data is better than public footage because it pairs studio audio with verified identity documents. FBI data shows $2.3 billion in losses for victims aged 60 and over in 2026, with emergency impersonation calls as the fastest-growing category. None of this is theoretical.

You cannot rotate your voice. It's just out there now, forever. ORAVYS, the voice intelligence platform that reported on the breach, is offering free forensic verification checks for victims. That helps. But the real fix is simpler and more uncomfortable. Stop collecting biometric data you don't absolutely need. And if you do collect it, at least admit what you're holding: the one password nobody can ever reset.