Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials

What’s new: Vercel has reported a security breach linked to the compromise of Context.ai, a third-party AI tool. An attacker gained access to a Vercel employee’s Google Workspace account, allowing unauthorized access to some internal systems and environment variables. While sensitive environment variables are encrypted and reportedly not accessed, a limited subset of customer credentials has been compromised. Vercel is collaborating with cybersecurity firms and law enforcement to investigate the breach.

Who’s affected

A limited number of Vercel customers had their credentials compromised. Vercel is directly notifying these customers and advising them to rotate their credentials immediately.

What to do

• Enable multi-factor authentication for Google accounts.
• Review activity logs for suspicious activity.
• Audit and rotate environment variables that contain secrets not marked as sensitive.
• Investigate recent deployments for unexpected changes.
• Rotate Deployment Protection tokens if applicable.

Sources

• The Hacker News