Vercel Breach May Be Larger Than Initially Thought, CEO Says

Vercel, a popular app and website hosting company, has revealed that hackers accessed some of its customers' data before the recent breach. The company initially said its internal systems were breached after an employee downloaded an app made by software startup Context AI, which hackers abused to gain access to the employee's work account, and subsequently, Vercel's systems.

In an update on its security incident page, Vercel said it had identified evidence of malicious activity on its network preceding the early-April breach after it expanded its initial investigation. The company said it had uncovered a small number of customer accounts with evidence of prior compromise that is independent of and predates this incident, potentially as a result of social engineering, malware, or other methods.

"We have uncovered a small number of customer accounts with evidence of prior compromise that is independent of and predates this incident, potentially as a result of social engineering, malware, or other methods," the update reads.

Vercel also said it discovered more customer accounts compromised by the April incident, but did not disclose details, only saying that it had notified customers known to be affected so far.

The new update suggests the data breach may be larger in scope and could have lasted longer than initially thought. Vercel CEO Guillermo Rauch confirmed on X that the hackers who compromised Vercel have been active "beyond that startup's compromise," referring to Context AI, which confirmed an earlier breach of its systems in a post this week.

• The hackers used the hijacked Vercel employee's account to gain access to some of the company's internal systems, including customer credentials that were not encrypted.

• Rauch's comments appear to add weight to earlier reporting by security researchers that a Context AI employee's computer was infected with infostealer malware after they allegedly looked up Roblox game cheats.

• TechCrunch reported on Thursday that embattled compliance startup Delve, accused of faking customer data, performed the security certifications for Context AI.

It's not yet known how many customers are affected by the Vercel breaches and customer data thefts. Both Vercel and Context AI have suggested that the breach may affect more companies, and that more victims may come to light.

The scope of the breach and the number of affected customers are still unknown. Vercel has not yet confirmed how the hackers broke into its systems, but Rauch pointed to early signs that the hackers relied on malware that compromises computers "in search of valuable tokens like keys to Vercel accounts and other providers."