Vercel confirms breach as hackers claim to be selling stolen data
Short summary
Vercel confirmed that attackers gained access by exploiting a compromised Context.ai Google Workspace OAuth app, then pulled non-sensitive environment variables and escalated privileges. The hacker claims to be selling API keys, source code, deployment data and employee records; Vercel has tightened its dashboard controls, urged secret rotation and marked sensitive variables for encryption.
- Breach originated from a Vercel employee's Google Workspace being compromised via a third-party app (Context.ai), not a direct Vercel exploit.
- Only non-sensitive, unencrypted environment variables were exposed because they weren't marked "sensitive"; core products like Next.js and Turbopack were unaffected.
- A hacker claiming to be ShinyHunters is selling access keys, source code, database dumps, and employee data (580 records with names/emails), though the real ShinyHunters have denied involvement and BleepingComputer hasn't verified the leak.
- Vercel responded by adding a dashboard toggle to mark and encrypt sensitive variables and is urging customers to rotate secrets immediately.
Full summary
Cloud platform Vercel confirmed that a limited set of customer accounts was exposed after attackers gained unauthorized access to its internal systems. The incident began when a Vercel employee’s Google Workspace account was compromised through a third-party AI service called Context.ai. From there, the attacker moved into Vercel environments and pulled down environment variables that hadn’t been marked “sensitive,” so they weren’t encrypted at rest.
CEO Guillermo Rauch says Vercel’s core services—Next.js, Turbopack and other open-source projects—weren’t touched. Still, the company has rolled out a dashboard update: an overview of all environment variables and a toggle to mark any as sensitive so they’ll be encrypted. Customers are urged to rotate secrets, review their variables, and enable that setting immediately.
On a hacking forum, someone claiming to be the ShinyHunters group said they’re selling Vercel access keys, source code, database dumps and employee account info. The post includes 580 records with names, Vercel email addresses and activity timestamps, plus screenshots of what looks like an internal enterprise dashboard. BleepingComputer hasn’t verified the data, and the real ShinyHunters have denied involvement in other chats.
Vercel’s security bulletin was updated on April 19 with new details on the OAuth app ID used in the breach (110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com). Rauch and his team are working with law enforcement and incident responders, and they’ll share more information as the investigation continues.