Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials

Vercel disclosed a security breach stemming from the compromise of Context.ai, a third-party AI tool used by an employee, which allowed attackers to access internal systems and customer credentials.

• •The attacker compromised an employee's Google Workspace account and gained access to environment variables not marked as sensitive
• •Environment variables marked as sensitive are encrypted and showed no evidence of being accessed
• •A limited subset of customers had their credentials exposed, and Vercel urged them to immediately rotate their credentials
• •A threat actor using the ShinyHunters persona claimed responsibility for the breach and requested $2 million for the stolen data
• •Vercel deployed new dashboard capabilities including an environment variables overview and improved sensitive variable management