Vercel Experiences Major Security Breach, Customer Data Stolen

Cloud app hosting giant Vercel has been hacked, with sensitive customer credentials stolen and sold online.

Vercel, a cloud app hosting giant, has experienced a major security breach, with hackers stealing sensitive customer credentials and selling them online. The breach is linked to another software maker, Context AI, and may affect hundreds of users across many organizations.

According to Vercel, the breach originated from an employee who downloaded an app made by Context AI and connected it to their corporate account, which is hosted by Google. The hackers used this connection (known as OAuth) to take over the Vercel employee's Google account and gain access to some of Vercel's internal systems, including credentials that were not encrypted.

Vercel says its Next.js and Turbopack projects were not affected by the breach. Both open-source projects are widely used by web and app developers.

In a statement, Vercel said it has contacted customers whose app data and keys were compromised. Vercel chief executive Guillermo Rauch advised customers to rotate any keys and credentials in their app deployments that are marked as 'non-sensitive.'

The breach is the latest in a string of 'supply chain' hacks in recent months that have targeted software developers whose code is widely used across the web. By compromising software that's widely used by companies and supports web infrastructure, hackers can steal credentials from a broad range of targets at once and gain further access to large amounts of data stored by other cloud giants.

Vercel said little else about the attack, except that it was investigating the incident and had sought answers from Context AI. Vercel warned of potential downstream breaches spanning the tech industry.

Context AI, which builds evaluations and analytics for AI models, confirmed on its website that it had a breach in March involving its Context AI Office Suite consumer app. The app allows users to automate actions and workflows across multiple third-party applications by way of an unnamed third-party service.

Context AI said it notified one customer of the breach, but based on Vercel's incident, it now believes that the incident is likely broader than first thought. Context AI said the hackers 'likely compromised OAuth tokens for some of our consumer users.'

The ShinyHunters hacker group, known for breaching cloud-based and database companies, told cybersecurity news site Bleeping Computer that they are not involved in this incident.

Vercel and Context AI have not responded to questions about the incident, such as how many of their customers could be affected.

• Vercel's Next.js and Turbopack projects were not affected by the breach.
• Vercel has contacted customers whose app data and keys were compromised.
• Vercel chief executive Guillermo Rauch advised customers to rotate any keys and credentials in their app deployments that are marked as 'non-sensitive.'
• Context AI had a breach in March involving its Context AI Office Suite consumer app.
• Context AI said the hackers 'likely compromised OAuth tokens for some of our consumer users.'
• Vercel and Context AI have not responded to questions about the incident, such as how many of their customers could be affected.