According to reports from crypto.news, Vercel has confirmed a security breach involving unauthorized access to parts of its internal systems. The company stated that the incident affected a limited number of customer credentials and reported detecting the issue soon after identifying unusual activity. Vercel informed affected users directly and advised them to rotate their credentials without delay, implementing monitoring and containment measures to prevent further access. The company has now engaged incident response experts and notified law enforcement, with the investigation actively progressing. As per Vercel's latest security bulletin, the company has notified law enforcement and will update this page as the investigation progresses, with services remaining operational throughout the incident.
As reported by crypto.news, the breach began with a compromised employee account through a third-party artificial intelligence tool called Context.ai. According to Vercel CEO Guillermo Rauch, the attacker gained access through this tool and entered the employee's Google Workspace account. Rauch described the attacker as highly sophisticated based on their operational velocity and detailed understanding of Vercel's systems. The company has confirmed that the initial access occurred after a Vercel employee's Google Workspace account was compromised via a breach at the AI platform Context.ai. The attacker then escalated access from the compromised account into Vercel environments, where they were able to access environment variables that were not marked as sensitive and therefore not encrypted at rest. Rauch explained that while Vercel stores all customer environment variables fully encrypted at rest, they have a capability to designate environment variables as 'non-sensitive' - unfortunately, the attacker gained further access through their enumeration of these variables. According to Vercel's latest security bulletin, the incident originated from a small, third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting its hundreds of users across many organizations.
Reports of the breach surfaced after a user known as ShinyHunters posted on a hacking forum offering alleged Vercel data for $2 million. The forum post claimed access to sensitive assets such as source code, database content, and internal employee accounts. According to crypto.news, Vercel has not confirmed the full scope of these claims, though it described the attacker as having detailed knowledge of its systems. The company has now provided additional details about the stolen data, including access keys, source code, and database data allegedly stolen from Vercel, along with access to internal deployments and API keys. The attacker also shared a text file containing 580 data records containing names, Vercel email addresses, account status, and activity timestamps, and shared a screenshot of what appears to be an internal Vercel Enterprise dashboard. However, BleepingComputer has not been able to independently confirm if this data or screenshot is authentic. In messages shared on Telegram, the threat actor also claimed they were in contact with Vercel regarding the incident and that they discussed an alleged ransom demand of $2 million. As per Vercel's latest security bulletin, the company has deployed extensive protection measures and monitoring and continues to investigate whether and what data was exfiltrated, with plans to contact customers if further evidence of compromise is discovered.
As reported by crypto.news, Vercel has taken steps to secure its infrastructure and review its software supply chain. The company confirmed that key projects such as Next.js and Turbopack remain safe despite the breach. Vercel has now rolled out updates to its dashboard, including an overview page of environment variables and an improved interface for managing sensitive environment variables. The company's investigation has confirmed that Next.js, Turbopack, and its other open-source projects remain safe. Vercel is strongly advising customers to review environment variables for sensitive information and enable the sensitive variable feature to ensure they are encrypted at rest. The company has implemented numerous defense-in-depth mechanisms to protect core systems and customer data, and is taking steps to protect its customers by advising them to review environment variables, use its sensitive environment variable feature, and rotate secrets if needed. According to Vercel's latest security bulletin, the company is working with Mandiant, additional cybersecurity firms, industry peers, and law enforcement and has also engaged Context.ai directly to understand the full scope of the underlying compromise.
As per Vercel's latest security bulletin, the company has provided comprehensive guidance for customers to protect their environments. The company recommends reviewing the activity log for your account and environments for suspicious activity through the dashboard or CLI, and reviewing and rotating environment variables that contain secrets such as API keys, tokens, database credentials, and signing keys. Vercel strongly advises customers to take advantage of the sensitive environment variables feature going forward, so that secret values are protected from being read in the future. The company also recommends investigating recent deployments for unexpected or suspicious looking deployments and ensuring that Deployment Protection is set to Standard at a minimum. For customers requiring assistance with rotating secrets or technical support, Vercel has provided contact information through vercel.com/help. The company emphasizes that environment variables marked as 'sensitive' in Vercel are stored in a manner that prevents them from being read, and currently does not have evidence that those values were accessed during the breach.
